[Zope] PythonMethods with Zope 2.2.5

[Brenton Bills]

Hi,
    I am trying to create a pythonmethod. Basicly I want to do some SQL and
then return the
   sql. I wish to pass through the name of the function I wish to call in a
variable to the pythonmethod
   I assumed it would be something like,

            querystring='SQL_get_something'
            query=getattr(self,SQL_get_something)
            query(varnametosql='A-C') # A-C being a range value I use for a
regex.

   I read in a previous mail that getattr is not valid for security reasons,
so what am I supposed to use
   to get this functionality. BTW would this be called like <dtml-var
pmethod(self,arg...)>?