Choosing appropriate search algorithm for a given task has never been a trivial issue. First, the task needs to be formulated as a search problem, then second, distinguishing characteristics of the search problem need to be analyzed so as to identify which search algorithm is appropriate for the task. This paper presents formulation of SQL injection detection as a grammar reachability search problem, and analyzes the distinguishing characteristics of the search problem, namely: representation of candidate solutions, nature and estimation of search space, variation operations, and fitness evaluation. The paper also present strategy for choosing appropriate search algorithm for the search task. The idea presented in the paper can help in providing further insight into formulation of task as a search problem as well as selecting the right search algorithm to handle the task.