Question: I agree that correct input validation is the only 'fool-proof' way to prevent SQL Injection, however it requires modifying a lot of code in existing applications, possibly might require a badly designed application to be re-structured.

There has been a lot of academic interest in automated mechanisms to prevent SQL Injection (won't go on listing them here, I've done a literature survey and seen at least 20), but I haven't seen anything that's actually been implemented.

Does anyone know of any framework that's *actually* in use outside an academic environment, either Signature-Based, Anomaly-Based, or otherwise?

**Edit**: I'm looking for something that **does not** modify the code-base.

Answer: 
The company i work for uses [Barracuda Web Application Firewall](http://www.barracudanetworks.com/ns/products/web-site-firewall-overview.php) for what you are talking about. From what I have seen it works fairly well. Basically if it detects suspect input it will redirect the user to a page of our choosing. This allows you to place a layer between the internet and your applications and does not require you to change any of your code. 

That said, it's a bad idea to not secure your applications.
The only way to leave the code untouched while patching vulnerabilities like SQL Injection is to use a web application firewall like the open source project [mod\_security](http://www.modsecurity.org/). Recently Oracle has released a [database firewall](http://www.oracle.com/technetwork/database/database-firewall/index.html) which filters nasty queries. This approach is better at solving the problem of SQL Injection, but that all it can address. 

WAF's are very useful and free, if you don't believe it [put it to the test](http://www.modsecurity.org/demo/). 

A WAF is just one layer. You should also [test the application](https://sitewat.ch/About/SQL_Injection)\* under it. This is a defense in depth approach. 

\*This is a service I sell with a limited free offer.