Re: [PHP-XML-DEV] registering functions or templates

Christian Stocker wrote:
> Maybe not exactly what you want, but at least from within XSLT you can 
> call php functions. Maybe we could do sth similar for XPath.
> 
> see http://blog.bitflux.ch/p1582.html for a little bit more information

Well, this is not exactly what I was thinking for. I tought about 
exporting a function name in a determined namespace. To have 
select="mynamespace:myfunction('r')"  instead of 
select="php:function('date', 'r')"/>

However the syntax you implements brings me the same functionnality with 
another syntax. I can live with it.



For another point of view your syntax has a minor security problem IMHO. 
It happens frequently that XSL are not written by the developper but by 
someone external. By opening all php functionnality (even the eval() 
function) you allow the XSL author to do what he want.
If I delegate the XSL authoring to someone else, he can inject 
everything he want to php. This may not be a good idea.
Without you php:function all he could do is calling a XML file.

Perhaps you should make accessible only functions which are explicitly 
exported (even if you keep the php:function() syntax you may be able to 
check if the name has been exported).

-- 
Eric