Replacing create_function()

create_function() built an anonymous function from string code at runtime. It was slow, hard to analyze statically, and a vector for injection when strings were concatenated from user input.

Lifecycle (php.net)

• Deprecated: PHP 7.2.0
• Removed: PHP 8.0.0

Modern replacement

Use real closures or first-class callables. Never eval user-controlled strings to recreate it.

Migration example

# LEGACY — create_function()
$mul = create_function('$a,$b', 'return $a * $b;');
echo $mul(3, 4);

# MODERN
$mul = static fn(int $a, int $b): int => $a * $b;
echo $mul(3, 4);

Scan before cutover

Search the tree for create_function() and paste samples into the PHP Version Compatibility Checker and PHP Deprecated Checker.

• Call to undefined function create_function()
• Removed PHP functions hub
• PHP 5 to modern PHP