In some cases the scanned SQL statements are classified as invalid. They may fall into one of the following:
The logon user does not have privilege to the tables or views referenced even though the syntax of the SQL statement is correct.
You can declare the database and user used to scan for SQL statements. If these do not match with the SQL statement, it may be classified as invalid.
The SQL Scanner is unable to identify SQL statements that are dynamically created if the text of the SQL statement is not all on one command line.