> And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually s

> And the fallacy you are making is describing adding more shit sauce on top as "a layered defense". A layered defense is when you take multiple, individually sane steps, with well defined boundaries to reduce risks that remain despite following good engineering practice. Some aspects of WAF may fit this bill, but SQL Injection defence assuredly does not. I haven't commented about how effective WAF is or if you should use it or not, so you're on a soapbox attacking a strawman here. > It's real easy not to have SQL injection exploits, you inform people that using anything apart from prepared statements to talk to the DB is a firing offence. I think relying on nobody to make mistakes (because you tried to scare them not to or otherwise) is awful advice in general. Even frameworks you rely on to create safe SQL queries can have exploits as well so you need to consider human error at several layers. Expect human error and plan your processes around it.