diff --git a/modules/core/lib/Auth/Process/GenerateGroups.php b/modules/core/lib/Auth/Process/GenerateGroups.php
index 3b4acf0bc937b03273a19130ec6a512b543633c7..61db17e7780af2a0558201bab37fbb505e9efd70 100644
--- a/modules/core/lib/Auth/Process/GenerateGroups.php
+++ b/modules/core/lib/Auth/Process/GenerateGroups.php
@@ -136,10 +136,24 @@ class sspmod_core_Auth_Process_GenerateGroups extends SimpleSAML_Auth_Processing
 		assert('is_string($string)');
 
 		return preg_replace_callback('/([^a-zA-Z0-9_@=.])/',
-			function ($m) { return sprintf("%%%02x", ord($m[1])); },
+			'self::escapeIllegalChar',
 			$string);
 	}
 
+	/**
+	 * Escapes a single special character.
+	 *
+	 * This function is used as a callback by escapeIllegalChars.
+	 *
+	 * @param array $matches The matches array provided by
+     * preg_*() functions. $matches[0] is the complete match, while
+	 * $matches[1] is the specific subpattern enclosed in parenthesis
+	 * that triggers the match.
+	 */
+	private static function escapeIllegalChar($matches) {
+		return sprintf("%%%02x", ord($matches[1]));
+	}
+
 }
 
-?>
\ No newline at end of file
+?>