Question: I agree that correct input validation is the only 'fool-proof' way to prevent SQL Injection, however it requires modifying a lot of code in existing applications, possibly might require a badly designed application to be re-structured.

There has been a lot of academic interest in automated mechanisms to prevent SQL Injection (won't go on listing them here, I've done a literature survey and seen at least 20), but I haven't seen anything that's actually been implemented.

Does anyone know of any framework that's *actually* in use outside an academic environment, either Signature-Based, Anomaly-Based, or otherwise?

**Edit**: I'm looking for something that **does not** modify the code-base.

Answer: 
The company i work for uses [Barracuda Web Application Firewall](http://www.barracudanetworks.com/ns/products/web-site-firewall-overview.php) for what you are talking about. From what I have seen it works fairly well. Basically if it detects suspect input it will redirect the user to a page of our choosing. This allows you to place a layer between the internet and your applications and does not require you to change any of your code. 

That said, it's a bad idea to not secure your applications.
The default behavior with PreparedStatements in Java where you pass in each parameter makes it mostly foolproof because the framework escapes the input for you. This doesn't prevent you from doing something like 

exec spDoStuff <var>

where spDoStuff does:

exec( <var> )

But if you use normal queries it's very effective. I don't know whether you'd consider it non-programmatic but the developer doesn't have to write the code to manage input validation themselves.

Like this:

```
int id;
String desc;
Connection conn = dataSource.getConnection();
PreparedStatement ps = conn.prepareStatement("SELECT * FROM table1 t1 WHERE t1.id = ? AND t2.description = ?");
// or conn.prepareStatement("EXEC spMyProcedure ?, ?");
ps.setInt(1, id);
ps.setString(2, desc);
ResultSet rs = ps.executeQuery();
...
rs.close();
ps.close();
conn.close();

```