I work with PHP and I think WAFs are potentially useful (and potentially problematic).