Isn't this security through obfuscation? Doesn't it shift the risk instead of eliminating it? That's fine if that's the intention, but that's a different risk mitigation strategy.

The post you replied to is saying it's categorically impossible to have an injection filter when user input interacts with executable statements.