[clhodapp]

It's not about old vs new, it's about strong vs weak. WAF was too weak to be your primary line of defense against SQL injection when it was first popularized and it's still too weak now.