onclick=alert(XSS pwn'd!) instead of
<script>alert(pwn'd!)</script> etc), but SQL does not. SQL injections are, by and large, very fickle and require very precise queries with very precise order. If the WAF is blocking union or select, you're probably dead in the water. You might be able to find a fancy way around it, but unless the client is paying big bucks and you're ready to spend a week on it, it's probably best to move on to another vulnerability.
It's unfortunate - I've done many penetration tests where compensating controls are used in place of secure coding. However, frustrations and bad practice aside, it is what it is.
PLEASE NOTE this doesn't mean joomla, PHP and whatever else doesn't have other vulnerabilities that can be exploited. Exploit-db.com is your friend here.
Joomla 1.5 has 86 results in exploit-db.com, and PHP 5 has undoubtedly hundreds if not thousands. Please remember: penetration testing and vulnerability scanning is all about ENUMERATION!