1) Because XML-RPC is stateless, you *must* authenticate for every function call. Browsers support this through something called "cookies", but you are still "authing" every request.

2) If you are worried about people hax0ring your blog password, then only allow submit's over https. (this is elegant. Think about it, and you will understand why).

3) If you do not like the "crappiness" of having to pass L/P on every call, then either move to public / private key methods (still have to have the initial setup / handshake), and sign all uploads (posts) with a private key (that you must pass with every post). Or, have a function ib.getAuthToken( $login, $password ) => String, and all you ib.postMe( $token, $crap, $crap2, $etc ) ... but you're still reduced to having to pass something to every damned function.

4) If you are smart, you will have written a XML-RPC wrapper class that allows you to simply "wrap" an existing class with all this crap anway. Allow me to sketch:

class THING {
function get() { ... }
function post($thing) { ... }
function _auth( $l, $p ) { ... }
function _write_to_db( $sql ) { ... }
}


class XML_RPC_WRAPPER {
function XML_RPC_WRAPPER( $classname )
{ $this->class = new $classname }
function process_xml_call( $name, $val_ar, $etc ) {
if( method_exists($this->class, $name && $name[0] != "_" ) {
$login = array_shift( $val_ar );
$pass = array_shift( $val_ar );
if( $this->class->_auth( $login, $pass )
{ $this->class->$name( $val_ar ) }
}
}


...It is rough (ie: not perfect) but it is a decent method of doing this. Still needs a lot of details to it, though. Now, all you do is to implement a standard PHP class, and then "Wrap it" with this XML_WRAPPER. Marshall things back and forth to your functions, and viola. Easy to maintain code, and when you find out about SOAP, you don't have to rewrite any of your core functionality, you just have to implement a different wrapper. :^)

--Robert P.S.: Until you figure out html processing, please look at nl2br function.