Client's web site getting SQL Injection attacks from another country. Bad guys not succeeding, but client wants us to fix it anyway. Huh?