Is F5 WAF support JSON syntax in their SQL injection inspection process.

Json is just a way to represent data using a specific string formatting standard. In short any json is a string.

In the other hand, F5 checks string inputs against signature matches, so sql injection can be detected in any string input.

Putting this together, F5 waf can detect malicious data in json inputs.

If this is not what you are asking for, could you provide further details?