token_custom_token_render randomly fails to pass data and options.

Some times, quite randomly, the $data and $options variables are not set (not accessible in the token php snippet).
And this error message might be returned:

Parse error: syntax error, unexpected T_STRING in /var/www/dev/mlegaignoux/projectaegis/modules/php/php.module(74) : eval()'d code on line 3

I traced it back to the function token_custom_token_render().

The syntax error on line 3 comes from the code prepended to the token code.

$code = '
<?php
  if ($static = drupal_static(\'' . $static_key . '\')) {
    extract($static);
  } ?>' . $code;

(please look at the original source code for reference. I can't get the quotes to show up correctly)

But as you can see there is not syntax error here. Or at least... not yet.
Because if $static_key contains a quote (') for example... we obviously have a syntax error.

And we have this a few lines before:
$static_key = 'token_custom_' . drupal_random_bytes(10);

So, a solution is to base64 encode it (because not only quotes causes problems).
$static_key = 'token_custom_' . base64_encode(drupal_random_bytes(10));

We can also completely replace drupal_random_bytes by something else I guess.
Or we could even avoid using drupal_static.
I don't really know, I'm new to drupal, but it seems like a strange way to use drupal_static.
And this random thing is not a 100% safe.

I'll try to submit a patch after more testing.