Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

just this morning i updated my debian server to php 5.3.9 , change log (last item in list) has a fix for this bug and now when running any hosted site using XSL transforms i get:

Warning: XSLTProcessor::transformToXml(): Can't set libxslt security properties, not doing transformation for security reasons

I'm not using any <sax:output> tags in my xslt at all.

Does anybody have any information on this, current chatter about it is thin, so i'm i little lost.

Using the suggestion about switching ini settings on and off either side of ->transformToXml():

ini_set("xsl.security_prefs", XSL_SECPREFS_NONE)



brings me back to the same error

Many thanks.

- Upgrading libxml and recompiling libxslt against the new version was a good suggestion, though has not fixed the issue.
- Compiling the latest php5.3 snapshot does not fix the issue.

I'm unsure what actually solved this, very sorry for anyone else having the same problem. firstly i upgraded libxml, then applied a few patches, then went into php source for the xsl parser and added some debugging and a few tweaks, after a few compiles getting the configure args right the error went away and wasn't reproducible.
I would definitely recommend upgrading libxml as Petr suggested below and then grabbing the latest snapshot from

share|improve this question
up vote 0 down vote accepted

Try updating your libxml extension. (2.7.7 -> 2.7.8 might have solved the problem in my case)

share|improve this answer
phpinfo() shows libxslt version: 1.1.26 compiled against libxml version 2.7.8 – Question Mark Jan 31 '12 at 15:12

I wish this was better documented (see php bug #61233), but from the source code it looks like the method name for PHP 5.4+ is "setSecurityPrefs" instead of "setSecurityPreferences" and the constant is "XSL_SECPREF_NONE" instead of "XSL_SECPREFS_NONE" (as opposed to what you can read in a comment for bug #54446). Altough, I would rather use 0 in case they change their mind about the spelling.

Right now I'm trying something like that :

    if (version_compare(PHP_VERSION, '5.4', '<')) {
        $oldval = ini_get('xsl.security_prefs');
        if ($oldval != '0') {
            $oldval = ini_set('xsl.security_prefs', '0');
            if ($oldval === false)
                ;//manage the error
    } else
        $oldval = $xsltproc->setSecurityPrefs(0);

and after the transform:

    if ($oldval != 0 && $oldval != '0') {
        if (version_compare(PHP_VERSION, '5.4', '<'))
            ini_set('xsl.security_prefs', $oldval);
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.