I am a fan of modsecurity (//) as a fast and cheap way to get decent protection for application layer attacks. But, as you know, risks are increasing and when the risk analysis performed to your organization shows that application disruptions have a big impact to the core business, it's time to strengthen controls and think about delivering protection from the code itself.
I have found useful PHPIDS library, which detects XSS, SQL Injection, header injection, directory traversal, DoS and LDAP attacks. Since it works from code, you can get the output and send it to your favorite alert vault to correlate security events.

Version 0.6.4 was recently released. More information at

Want to use same functionality in perl? Try /dist/CGI-IDS/view/lib/CGI/IDS.pm. It is based on php-ids.

The link for this article located at SANS is no longer available.