Fix a php code injection vulnerability

The vulnerability was reported by Manish Kishan Tanwar, see the
advisory:

 http://packetstormsecurity.com/files/126713/clipperz-exec.txt

The fix is currently pushed for urgent patch and does not address
every issue. Arbytrary object creation is still allowed for
instance.