How to use objects in templates in secure way

Question

Hello everyone

Modern template engines for php (say, dwoo or smarty) can use objects as variables. You can use {$obj->method()}, which is really convenient, and i am using this a lot. But, there is a clear security problem with exporting directly objects from ORM, which have methods such as insert, delete etc. Is there any sane method to expose only part of methods to template engine? I was thinking of wrapper exposing only whitelisted methods:

$aTplVars = array (new TplWrapper(new User($nUserId),  array('getAccount','getStatus')));

What do you thinking (there is clear performance overhead)? Or maybe there is something like that in some existing template engines for php?

Answer 1

You can't "cripple" an object in PHP (or any language I know) after it's been created. Using objects might seem nice, but you should fetch the relevant data for your template in the controller and put it into an array which you can safely assign to the template.