I would like to know if you can make Sql Server look at incoming query strings and reject ones that match a certain pattern. In other words, for a certain class of queries (perhaps identified by a regular expression), I want to know if Sql Server could be made to return an error message rather than processing them as it normally would.
To be more concrete, and to give a potential use case, consider this description of a Sql Injection attack. If my website were under sustained attack from techniques along those lines, and if getting the website patched looked like a lengthy process, it would be tempting (if Sql allowed it) to try to get some provisional relief by putting something in Sql that basically said
If a query matches regex CAST(0x[0-9A-Za-z]{20,} then don't execute it!
My guess is that, if this sort of filtering is possible, then doing it would require writing some kind of custom Sql Server Add-In DLL. But maybe you can do something like this with Sql Server 2008's built-in auditing features? I really have no idea, and I'm not sure where in the documentation would be the best place to start looking.
If you want to point out why the database is a stupid place to try to block sql injection attacks, that's fine. But my primary question is not whether it's a good idea in this particular use case but whether this sort of query filtering/rejection is even possible.