My client’s WAF blocks some legitimate POST requests, mistaking them for SQL injection. Since altering their WAF isn’t an option, how can I handle this effectively? What LLMs suggest is to encode the parameter’s value at client side. Is this the right approach?