As @Arminius mentioned in a comment, there are products (software or hardware) called "Web application firewalls" (WAFs) what inspect network traffic before it hits your web server process. Unfortunately, they're really not reliable. Not only are there commonly-known bypasses to some kinds of WAF, the protection they provide is inherently a matter of blocking stuff that might be harmful, without knowing how it will be used, which means they usually need to be configured somewhat conservatively to prevent false positives. They also tend not to be updated as quickly as new vulnerabilities are discovered; they're reactive to known threat patterns, but aren't generally proactive. They also can't protect against all potential ways to screw up a web application even within the context of XSS and SQLi; I've seen sites vulnerable to XSS via crazy things like "if parameter A evaluates to true
, parameter B will get passed to eval
", which was very stupid on the developer's part but isn't something a WAF could ever catch.
As part of a defense-in-depth strategy, WAFs have their place, much like antivirus software. They're not suitable as an alternative to a proper security review, though. In addition to their weaknesses to some XSS or SQLi vectors, they are also totally incapable of preventing other classic web app vulns like CSRF, clickjacking, or session fixation, and are not particularly likely to catch things like arbitrary file include, arbitrary file upload, or OS command injection.
Spend your money on getting somebody who knows web app security to review your site long before you bother looking at WAFs.