A hidden "SQL injection filter" in cloudflare seems like a truly awful idea. What happens when an incompetent developer codes up a vulnerable website, and it s

A hidden "SQL injection filter" in cloudflare seems like a truly awful idea. What happens when an incompetent developer codes up a vulnerable website, and it seems to be protected through this feature, and this goes unnoticed for many years until cloudflare is phased out, the feature is disabled, or some other change to the way things are done outside the original dev's control comes along? And what happens when you can bypass it as soon as there is some other way (i.e. base64 encoded, or not in HTTP at all) for user input to reach the API? And of course, what happens when you can bypass it due to it having a bug or being deficient by design? The lesson: do NOT "sanitize" your inputs, ever. Just keep your data types straight (by using things like prepared statements to convert a string to an SQL-escaped string) and block all inputs that should never end up in the database in the first place.