A traditional firewall decides based on addresses and ports. A WAF reads the web traffic itself: the URL, the headers, the cookies and the request body. It compares what it sees with rules that describe known attack patterns, such as SQL injection strings or attempts to read files outside the web root, and it blocks, challenges or logs the requests that match.
A WAF can run as a cloud service in front of your site, as a module in a web server or as a hardware or software appliance. It is useful because it can stop common attacks quickly, and it can protect software that you cannot patch yet. Many vendors publish emergency rules for newly disclosed vulnerabilities within hours.
It is not a substitute for fixing the flaw. A rule only recognizes the shapes of attack it was written for, and an attacker who changes the shape of the request may get past it. Rules also have to be tuned, because a strict rule can block real users.
Treat a WAF as a seat belt and not as an armored door: keep it on, keep its rules updated, read its logs, and still patch the application behind it.