I'm not sure if this will help. But we had some troubles with some
xsl:include functions with our PHP scripts. So we flagged the files to be
included and dealt with them before Sablot got a hold of them. Then all the
information was finally passed to the browser in HTML.
Perhaps some flaggings and scripting can help you too.