SQL Injection Check Function

Niantic services receive user-controlled strings from Pokémon GO and Pokémon Sleep clients. Implement a detector for injection-like payloads that may be disguised with URL encoding, HTML entities, Unicode compatibility characters, comments, or inconsistent casing.

Return True when the input contains one of these suspicious structures outside a quoted literal:

1. A statement separator ;.
2. A line comment beginning with -- or a block comment beginning with /*.
3. The word sequence union select.
4. The token sequence or 1 = 1, allowing arbitrary whitespace.
5. An unmatched single or double quote.

Quoted text must be ignored while searching for keyword and numeric patterns. For example, "union select" is harmless because the words occur inside a quoted literal, while ' union select is suspicious because the quote closes before the keywords.

Formal Specification

Write detect_injection(value), where value is a non-empty string. Return a Boolean. Before scanning, repeatedly URL-decode and HTML-decode the value at most three times, then apply Unicode NFKC normalization and lowercase conversion. Decoding stops early when a pass makes no change.