Question - why is it better to create a plugin yourself?

This module exposes PHP to 'any' administrator, and also on a production site. Not all administrators know php as good as they think they do, so they might open security hoels, or save the view with corrupt php, breaking the site.

Programming your handler requires a better programmer, and you'll normally do that on a test site.

see also #1132246: Require bad_judgement

@johnv could be beneficial to include your advice in the README.txt file #1221160: No README.txt file distributed with the project

Would it be feasible to have some sort of “Bake into Custom Views Handler Module” feature, that would take code that you’ve written and tested using Views PHP, and automatically export it into a properly formatted Custom Views Handler Module?

Then Custom PHP can be used for quickie development, and only “baked” Custom Views Handler Modules exported from it would be used in staging or live sites.

I could see this being implemented as a “Bake” button on each Views PHP UI form (for a Field, Filter, Sort, Area, etc.), or as a utility (perhaps using Drush?) that collects all Views PHP instances found either in a single View Display, all Displays in a given View, or site-wide, and collects them into a single Custom Module with multiple Views Handlers. Assuming it has write access to the necessary directories, it would then write out the code into the proper places, replace the occurrences of the Views PHP with the new custom Views Handlers in the View(s), and then optionally disable Views PHP when done.

Should this be suggested as a separate Feature Request, Task, or Plan Issue?

This blog article gives good reasons, and also provides some example code and a walkthrough for making your own Views Handlers.

In addition to security, there’s also the performance issue. As I understand it, this module basically reads the PHP code in from the various UI textareas and executes it on the fly. When PHP code is read from strings (e.g. from database varchars) and executed on the fly, it cannot be properly tokenized and OpCached and otherwise optimized as can code that’s in actual PHP code files on disk. The PHP interpreter has to interpret the original text code every time.