<p>I'm working for a customer with a huge legacy codebase consisting of various Java en JSP based applications.</p>

<p>Most querying is done using the home-build 'orm' system. Some applications use Plain Old JDBC. Some applications are based on Hibernate (yes HQL build with plus signs is a potential problem as well). Some of the older applications are entirely writen in JSP. </p>

<p>I've found a couple of SQL inject bugs manually. But I could really use some sort of tool to search for potential weak spots.</p>

<p>Any ideas?</p>

When I was working on localization of "this-will-never-need-localization" application, we use a home-made tool to analyzing compiled code ( IL in .NET, it is same as byte-code in Java ).
You can find calling the specified methods which works with DB ( typicaly CRUD operations ) wicht has a string parameter with SQL command, and track the string instance up and check for concating.
We used the .NET Reflector for decompiling and tracking strings. But I don't know, if is available similar tool for Java :(.