Why should a web application firewall not be seen as a cure-all?

A WAF is no substitute for a properly built, robust and secure web application. It filters what it recognises, under the limits of its rule set and its configuration, so studying the peculiarities and limits of the specific WAF in depth is strongly recommended.

A WAF is a filter in front of the application, not a fix inside it. It works from patterns: whatever an attacker can phrase so that no rule matches (an unusual encoding, a new technique, an oversized request) reaches the application unchanged. Conversely, legitimate traffic that happens to match a rule gets blocked. The application must therefore still validate its input and, for example, pass user input to the database only through parameterised queries. The WAF is an additional layer that buys time and filters noise, not the place where the vulnerability is closed.

Go deeper:

• OWASP SQL Injection Prevention Cheat Sheet — the fixes that belong in the application itself.
• Defense in depth (computing) — Wikipedia — why a WAF is one layer among several, not the only one.