export should not use JSON

We don't want to use eval(), as it imposes a high security risk. JSON is easy to read and easy to support and does not make me nervous. However, you can overwrite the import() and export() methods in your own entity controller to go with PHP.

So for me this is a won't fix.

oh, I wasn't aware of drupal_var_export() - that deprecates entity_var_export(). Let's point it to drupal_var_export() and mark it deprecated.

entity_var_json_export() is there for long and there is no reason to remove it.

The remaining question, is the default export format to use. I prefer JSON too, as
* it has no security implications. Using PHP by default, e.g. would require the admin UI to introduce separate permissions + do not make it possible to allow imports for users without having to grant them PHP execution permissions.
* it forces modules to not create exports with classes in code, thus producing more reliable exports.
* it is easily parse-able, even across systems.

Leaving the issue open, so others can chime into the discussion.

Please reopen if still an issue.