The Error
You upgraded PHP (or your host quietly did it for you), and now your logs are flooded with:
Deprecated: Function create_function() is deprecated in /var/www/html/wp-includes/functions.php on line 4587
Deprecated: Function create_function() is deprecated in /var/www/html/app/lib/template.php on line 112
On PHP 8.0 this escalates to a fatal error and your page goes blank. At 2 AM, that's the last thing you need.
Why This Happens
create_function() shipped with PHP 4.0.1 back in 2000. It was deprecated in PHP 7.2 and removed entirely in PHP 8.0. Under the hood it's just a wrapper around eval() — it compiles an anonymous function from a plain string at runtime. That's a security hole and a performance drain. PHP 5.3 introduced proper closures that do the same job with none of the baggage.
Seeing this error after an upgrade means either your own code or a third-party library is still using this old pattern.
Step 1 — Find Every Occurrence
Don't guess the scope — measure it. Run this from your project root:
grep -rn "create_function" /var/www/html --include="*.php"
To skip vendor/ and node_modules/:
grep -rn "create_function" /var/www/html \
--include="*.php" \
--exclude-dir=vendor \
--exclude-dir=node_modules
Note every file and line number. Ten hits in your own code is a morning's work. If everything is inside vendor/, jump straight to Step 3.
Step 2 — Replace create_function() With a Closure
The pattern is always the same: a string of arguments, a string of code. Swap it out for a real anonymous function.
// Old — PHP 4 style, deprecated in 7.2, removed in 8.0
$greet = create_function('$name', 'return "Hello, " . $name . "!";');
echo $greet('World'); // Hello, World!
// New — works on PHP 5.3 through 8.x
$greet = function($name) {
return 'Hello, ' . $name . '!';
};
echo $greet('World'); // Hello, World!
Callbacks passed to array_map, usort, and similar functions are the most common culprit:
// Old
$doubled = array_map(create_function('$x', 'return $x * 2;'), [1, 2, 3]);
// New — anonymous function
$doubled = array_map(function($x) { return $x * 2; }, [1, 2, 3]);
// Cleaner still with arrow functions (PHP 7.4+)
$doubled = array_map(fn($x) => $x * 2, [1, 2, 3]);
When the old code interpolates outer variables into the string body, translate that to a use clause:
// Old — string interpolation hack
$multiplier = 5;
$fn = create_function('$x', "return \$x * {$multiplier};");
// New — explicit variable capture
$multiplier = 5;
$fn = function($x) use ($multiplier) {
return $x * $multiplier;
};
Step 3 — Dealing With Third-Party Code in vendor/
Never edit files under vendor/ directly. The next composer update will overwrite your changes and you're back to square one.
Check whether a newer version of the offending package exists:
composer outdated
Update just that package:
composer update vendor/package-name
No update available and you need PHP 8.0 now? Two paths forward:
- Fork the package, apply the fix yourself, and point
composer.jsonat your fork via arepositoriesentry. - Replace it with an actively maintained alternative.
WordPress sites: outdated plugins are responsible for the majority of these warnings. Update them in bulk:
wp plugin update --all
Step 4 — Suppress Deprecation Notices Temporarily (Stopgap Only)
Need to ship a hotfix tonight while the proper refactor waits? Suppress deprecation notices at the application level. Clear disclaimer: this silences the warning on PHP 7.x. On PHP 8.0 the function is gone and it will still crash.
// bootstrap/index.php — mark this TODO and come back to it
error_reporting(E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED);
Or via config files:
# php.ini
error_reporting = E_ALL & ~E_DEPRECATED
# .htaccess (Apache)
php_value error_reporting "E_ALL & ~E_DEPRECATED"
This buys you hours. Not weeks.
Verify the Fix
Watch the PHP error log while reloading the affected page:
# Tail PHP error log
tail -f /var/log/php/error.log
# or
tail -f /var/log/nginx/error.log
Lint a specific file from the command line:
php -l path/to/fixed-file.php
# Output: No syntax errors detected in path/to/fixed-file.php
Lint the whole application directory recursively and filter out clean files:
find /var/www/html/app -name "*.php" -exec php -l {} \; 2>&1 | grep -v "No syntax errors"
No output means you're clean.
Catch These Before They Hit Production
One create_function() call that slips through to a PHP 8.0 server will blank your page. Add Rector to your CI pipeline and stop that class of bug at commit time:
# Install Rector
composer require rector/rector --dev
# Dry-run: see everything it would change
vendor/bin/rector process src --dry-run
Rector understands the create_function() → closure transformation and can rewrite dozens of occurrences automatically. Run it once, review the diff, commit. Done.
Quick Reference
- PHP 7.2 —
create_function()deprecated (E_DEPRECATED warning) - PHP 8.0 —
create_function()removed (fatal error, page blank) - Fix: rewrite as anonymous function
function() {}or arrow functionfn() => - Third-party code: update the package via Composer — never edit
vendor/directly - CI guard: add Rector or PHPStan to catch deprecated calls before deploy