If you are in charge of testing code for escaping issues, and you do that through a WAF, you might not be very good at your job.