>SQL Injection is something every web application should do. This is a completely separate issue from CSRF (cross site request forgery), but they conflate the t

>SQL Injection is something every web application should do. This is a completely separate issue from CSRF (cross site request forgery), but they conflate the two as if they're one. It sounds like they're describing a web application firewall that detects and blocks both of those things together. (I assume the application itself is also secured to their knowledge against these separately.)