SQL Injection - how works ?

Hi everyone, i have a question about IPS SQL Injection. On what basis Fortigate makes decision that this a sql injection ? If in URL contains a query - WHERE , SELECT etc ?

I cant find the information and i want to know the mechanism works.