This story is pretty horrifying. SQL injection attacks are trivial to protect against - many popular web application development environments (such as Django and Ruby on Rails) provide protection out of the box, and in other environments a simple coding pattern called parameterized statements provides full protection for no extra effort at all. There's certainly no need to buy an application firewall or other external piece of software!

The problem here is that many web developers fail to understand even the most basic concepts of web application security. The solution is better training or just to hire better developers.

Click to read the article this is in response to.