- How do I install umpirsky/twig-php-function in a Laravel app?
- Run composer require umpirsky/twig-php-function. It is not a Laravel package, so there is no auto-discovery or config publishing; you register the extension manually with the Twig environment. If you use TwigBridge, add it to the extensions array in config/twigbridge.php.
- Does this package work with Laravel Blade templates?
- No. Laravel is Blade-first, and this package only extends Twig; it does nothing for Blade templates. To use it you must already have Twig rendering in your app, typically through rcrowe/twigbridge or a custom integration.
- How do I register the php_function extension with TwigBridge?
- Add the extension class to the extensions array in config/twigbridge.php, or register it directly on the Twig environment with addExtension() in a service provider. The package ships no service provider of its own, so wiring is your responsibility. Confirm the extension class name from the README before registering.
- Is it safe to use php_function with user-editable templates?
- Treat it as a remote code execution surface. If any template source can be influenced by an attacker, including admin-editable templates, CMS blocks, database-stored emails, or multi-tenant themes, php_function can invoke arbitrary PHP such as system. Use it only for internal, developer-authored templates, or avoid it entirely.
- Which Twig and Laravel versions does umpirsky/twig-php-function support?
- It supports Twig 2 and Twig 3 and is framework-agnostic, so it is not tied to a specific Laravel release. On Laravel you also need a Twig integration such as TwigBridge, and that integration determines Laravel and PHP compatibility. Twig 3 removed extension APIs that older packages still target, so verify your installed versions.
- Can I restrict which PHP functions are callable from Twig?
- There is no built-in allowlist or callable map; the value proposition is the absence of one. To enforce a curated set you would need to fork the extension, wrap it, or write a custom Twig extension with named functions. For most teams the custom extension is the safer path.
- How do I call static methods from Twig with this extension?
- Yes, the extension includes a companion callable for static methods in addition to php_function(). You pass the class and method names as strings, and they are resolved at render time. Check the README for the exact syntax and argument order.
- Will php_function mistakes fail at compile time or at runtime?
- Function names are strings resolved when the template renders, so typos, signature drift, and PHP-version removals become runtime fatals rather than build failures. That is the worst failure timing for production. Add template smoke tests that render every Twig view if you adopt it.
- Is umpirsky/twig-php-function actively maintained, and how do I report a security issue?
- The supplied record has no repository metadata, so provenance, issue history, and security-response posture must be verified directly before adoption. The 64-star and 0.93-score signals reflect popularity and static hygiene, not fitness for a privileged-call primitive. Check the repository for recent commits and a documented security contact; if none exists, treat that as a risk.
- What are alternatives to calling PHP functions inside Twig templates?
- Write a small custom Twig extension that exposes ten explicitly named functions, or use Twig's built-in filters and functions where possible. If you are on Blade, use Blade directives and helpers instead. A curated extension is usually cheaper than adopting, wrapping, and governing a privileged-call primitive.