>>This is for an expression evaluator, so no commands allowed (unless, of course, they are inside an EXECSCRIPT). If the name ends with a (, then it is a function/method (although I'm still sure about methods :) ), otherwise it is a variable.
>
>
>It's not trivial
>
>(1) When you split into tokens, the ( is a separator, so no name will end with a (
>
>(2) You can only check what follows
>
>(3) There is no clear distinction between () and []
>So it may be an array

The function pattern retrieves the ( following a function name.

You have a point regarding array references. Although it won't matter as security issues go, for completeness I should also look for that.

I take the opportunity to thank all of you for your valuable inputs. This little fellow is growing stronger because of you.