create_function() — The Dynamic Code Smell

TL;DR

Explanation

create_function('$x', 'return $x * 2;') compiled a string as PHP code using eval() under the hood. Problems: (1) RCE risk if any argument came from user input, (2) not analysable by static analysis, (3) worse performance than closures, (4) no IDE support. Deprecated PHP 7.2, removed PHP 8. Direct replacement: function($x) { return $x * 2; } or fn($x) => $x * 2. Rector handles the migration. It was a PHP 4 workaround — closures (PHP 5.3) made it completely obsolete.

Common Misconception

Why It Matters

Common Mistakes

• Using create_function() with any user-controlled content — direct RCE.
• Not using Rector to automate migration to closures.
• Not knowing arrow functions (fn($x) => ...) are available as a cleaner alternative.

Code Examples

// Deprecated + RCE risk if $code from user:
$fn = create_function('$x', 'return $x * 2;');

// Removed in PHP 8 — fatal error

// Closure:
$fn = function($x) { return $x * 2; };

// Arrow function (PHP 7.4+):
$fn = fn($x) => $x * 2;

References

• ↗ https://www.php.net/manual/en/function.create-function.php

Tags

Related Terms