I don’t understand how this “prevents code injection” in any meaningful way. The blog post boasts on and on about how it’s going to solve the problem - but at t

I don’t understand how this “prevents code injection” in any meaningful way. The blog post boasts on and on about how it’s going to solve the problem - but at the end of the day, a code injection bug is still a code injection bug. Sure, the attacker now has to program in a demented, randomized dialect of PHP, but given enough patience they’re bound to get something usable running. Plus this breaks practically any code that actually relies on dynamic PHP features to generate code, because now the code generators have to be manually edited to spit out obfuscated code instead of normal PHP.