Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

just this morning i updated my debian server to php 5.3.9 , change log (last item in list) has a fix for this bug and now when running any hosted site using XSL transforms i get:

Warning: XSLTProcessor::transformToXml(): Can't set libxslt security properties, not doing transformation for security reasons

I'm not using any <sax:output> tags in my xslt at all.

Does anybody have any information on this, current chatter about it is thin, so i'm i little lost.

Using the suggestion about switching ini settings on and off either side of ->transformToXml():

ini_set("xsl.security_prefs", XSL_SECPREFS_NONE)



brings me back to the same error

Many thanks.

- Upgrading libxml and recompiling libxslt against the new version was a good suggestion, though has not fixed the issue.
- Compiling the latest php5.3 snapshot does not fix the issue.

I'm unsure what actually solved this, very sorry for anyone else having the same problem. firstly i upgraded libxml, then applied a few patches, then went into php source for the xsl parser and added some debugging and a few tweaks, after a few compiles getting the configure args right the error went away and wasn't reproducible.
I would definitely recommend upgrading libxml as Petr suggested below and then grabbing the latest snapshot from

share|improve this question
up vote 0 down vote accepted

Try updating your libxml extension. (2.7.7 -> 2.7.8 might have solved the problem in my case)

share|improve this answer
phpinfo() shows libxslt version: 1.1.26 compiled against libxml version 2.7.8 – Question Mark Jan 31 '12 at 15:12

I wish this was better documented (see php bug #61233), but from the source code it looks like the method name for PHP 5.4+ is "setSecurityPrefs" instead of "setSecurityPreferences" and the constant is "XSL_SECPREF_NONE" instead of "XSL_SECPREFS_NONE" (as opposed to what you can read in a comment for bug #54446). Altough, I would rather use 0 in case they change their mind about the spelling.

Right now I'm trying something like that :

    if (version_compare(PHP_VERSION, '5.4', '<')) {
        $oldval = ini_get('xsl.security_prefs');
        if ($oldval != '0') {
            $oldval = ini_set('xsl.security_prefs', '0');
            if ($oldval === false)
                ;//manage the error
    } else
        $oldval = $xsltproc->setSecurityPrefs(0);

and after the transform:

    if ($oldval != 0 && $oldval != '0') {
        if (version_compare(PHP_VERSION, '5.4', '<'))
            ini_set('xsl.security_prefs', $oldval);
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .