Some FortiGate features are meant to protect clients, not servers. For example, FortiGuard web filtering blocks requests based on the category of the server's web pages. Antivirus prevents clients from accidentally downloading spyware and worms. Neither protects a server (which doesn't send requests- it receives them) from malicious scripts or SQL injections. Protecting web servers requires a different approach because they are subject to other kinds of attacks. This is where WAF applies. The WAF feature is available only in proxy inspection mode.
Web Application Firewall (WAF) is a security feature that protects web applications from a variety of attacks, including SQL injections. It analyzes and filters HTTP traffic between a web application and the internet to block malicious attempts to exploit vulnerabilities in the application. By monitoring and filtering HTTP traffic, WAF helps prevent attacks such as SQL injections, cross-site scripting (XSS), and other web application vulnerabilities.