[Zope] PythonMethods with Zope 2.2.5

Hi, I am trying to create a pythonmethod. Basicly I want to do some SQL and then return the sql. I wish to pass through the name of the function I wish to call in a variable to the pythonmethod I assumed it would be something like, querystring='SQL_get_something' query=getattr(self,SQL_get_something) query(varnametosql='A-C') # A-C being a range value I use for a regex. I read in a previous mail that getattr is not valid for security reasons, so what am I supposed to use to get this functionality. BTW would this be called like <dtml-var pmethod(self,arg...)>?