"I seriously doubt any ISP monitors their customers' POST data for SQL-like text."

A lot of firewall products look for suspicious HTTP traffic (such as SQL injection, and XSS attacks). It's actually likely that the server hosting the web application has something like this installed (or at least they should).

Upon detection of such activity, emails to abuse@yourisp.com usually go out indicating that the ISP will be blocked if the activity continues. If it's a well known site, you can bet that you'll be hearing from your ISP.

At any rate, if you're going to do any "cracking" from your own ISP, you're an idiot and deserve to get caught.