Using a WAF to "secure" your web app is like "fixing" your car window by taping a plastic sheet in its place. It might be better than doing nothing, but it is no substitute for actually fixing the problem.