Apply ASM attack signatures to URLs?

Depends on how your policy is configured. The out-of-the-box General Signature List includes SQL Injection signatures, so I would verify if they are enabled. Go to your policy, then go to Security ›› Application Security : Attack Signatures : Attack Signatures List. Plug in 1=1 in the Containing String field and select SQL-Injection in the Attack Type field then hit Go. From the results, ensure the applicable signatures are Enabled and not in Staging mode.