Fix your SQLi problems. In-depth defense, etc. You might protect your web-facing service, but what about someone already inside your network (RAT)? WAFs are a

Fix your SQLi problems. In-depth defense, etc. You might protect your web-facing service, but what about someone already inside your network (RAT)? WAFs are an additional measure, that you probably can't deploy between each pair of machines that communicate together. Have someone perform a pentest, see how bad it is. Also, they're expensive, more so than a check for weird chars in a comment field.