A company's security policy states that its own internally developed proprietary Internet facing software must be resistant to web application attacks. Which of the following methods provides the…

Requiring secure coding practices - such as parameterized queries, output encoding, and input validation - addresses the root cause of vulnerabilities like SQL injection and XSS at the development stage, preventing them from ever reaching production. This defense-in-depth approach is more comprehensive than any single compensating control applied after the fact.

Client-side input filtering can be trivially bypassed by an attacker intercepting and modifying HTTP requests before they reach the server, making it an unreliable primary defense.

Escaping character sequences at the application tier addresses only a subset of injection vulnerabilities and is itself a component of secure coding rather than a replacement for it.

A WAF provides perimeter-level detection and filtering but can be bypassed through obfuscation or zero-day techniques and does not remediate underlying code vulnerabilities.