Slightly more ““secure”” parsing of php values through eval()

somewhat_secure_eval.php

<?php
$phpString = '$values = ["test"];';
$code = <<<PHP
    <?php
    \$values = [];
    \$string = <<<'STRING'
    $phpString
    STRING;
    eval(\$string);
    echo serialize([\$values]);
    PHP;

// Get all enabled internal functions besides serialize
// in order to disable them before evaluating the script.
$functions = get_defined_functions()['internal'];
$serializeIndex = array_search('serialize', $functions, true);
array_splice($functions, $serializeIndex, 1);
$fnToDisable = implode(',', $functions);

// Put the code evaluating the raw php string into a temporary file,
// execute the file with a separate php process,
// retrieve the serialized data, and unserialize it.
// This, of course, does not disable constructs like eval() itself,
// but even functions within an eval wont work anyway.
$tmpFile = tmpfile();
fwrite($tmpFile, $code);
$path = stream_get_meta_data($tmpFile)['uri'];
$command = "php -d disable_functions=$fnToDisable $path";
$result = shell_exec($command);
fclose($tmpFile);

$data = @unserialize($result, [false]);

Use at your own risk lol