13 lines
764 B
Plaintext
13 lines
764 B
Plaintext
|
==== Parameterized Queries
|
||
|
|
For XPath injections, the cleanest way to do so is to use parameterized queries.
|
||
|
|
|
||
|
|
XPath allows for the usage of variables inside expressions in the form of `$variable`. XPath variables can be used to construct an XPath query without needing to concatenate user arguments to the query at runtime. Here is an example of an XPath query with variables:
|
||
|
|
|
||
|
|
----
|
||
|
|
|
||
|
|
/users/user[@user=$user and @pass=$pass]
|
||
|
|
|
||
|
|
----
|
||
|
|
|
||
|
|
When the XPath query is executed, the user input is passed alongside it. During execution, when the values of the variables need to be known, a resolver will return the correct user input for each variable. The contents of the variables are not considered application logic by the XPath executor, and thus injection is not possible.
|