I wouldn't use a Regex for this because of the problems you describe, false positives et al. SQL::Parser looks like a promising candidate for doing this reliably.
holli
You can lead your users to water, but alas, you cannot drown them.
This was my first thought as well, to use a parser instead of a regex whenever possible. Unfortunately, it turned out that it doesn't seem to work. I checked the SQL::Statement::Syntax docs and they say that only INSERT statements of the form INSERT INTO $table [ ( $col1, ..., $colN ) ] VALUES ( $val1, ... $valN ) are supported, and "inserting from a subquery is not currently supported". Posting the code here anyway, maybe I missed something.