Page History

&lt;users&gt;<users>
  &lt;user&gt;<user>
    &lt;login&gt;Utah&lt;/login&gt;<login>Utah</login>
    &lt;password&gt;C^f3&lt;/password&gt;<password>C^f3</password>
  &lt;/user&gt;</user>
  &lt;user&gt;<user>
    &lt;login&gt;Bohdi&lt;/login&gt;<login>Bohdi</login>
    &lt;password&gt;C@fe&lt;/password&gt;<password>C@fe</password>
  &lt;/user&gt;</user>
  &lt;user&gt;<user>
    &lt;login&gt;Busey&lt;/login&gt;<login>Busey</login>
    &lt;password&gt;cAf3&lt;/password&gt;<password>cAf3</password>
  &lt;/user&gt;
&lt;/users&gt;</user>
</users>

str_query = ""//users/user[LoginID/text()= "" & login & 
            "" and password/text()="" & password & "]""]"

class XpathInjection {
  private boolean doLogin(String loginID, String password)
    throws ParserConfigurationException, SAXException,IOException, XPathExpressionException {

    DocumentBuilderFactory domFactory = DocumentBuilderFactory.newInstance();
    domFactory.setNamespaceAware(true);
    DocumentBuilder builder = domFactory.newDocumentBuilder();
    Document doc = builder.parse(""users.xml"");

    XPathFactory factory = XPathFactory.newInstance();
    XPath xpath = factory.newXPath();
    XPathExpression expr = xpath.compile(""//users/user[login/text()='"" + 
         loginID +"'""'" + ""and password/text()='""+password+""' ]"");
    Object result = expr.evaluate(doc, XPathConstants.NODESET);
    NodeList nodes = (NodeList) result;
   
    // Print first names to the console 
    for (int i = 0; i &lt;< nodes.getLength(); i++) {
      System.out.println(nodes.item(i).getNodeValue());}       
         
    return (nodes.getLength() &gt;>= 1);
  }
}

Document doc = new Builder().build(""users.xml"");
XQuery xquery = new XQueryFactory().createXQuery(new File(""login.xry""));

Map queryVars= new HashMap();

queryVars.put("loginid""loginid", "Utah""Utah"); // user name hardcoded for illustrative purposes
queryVars.put("password""password", "securecoding""securecoding"); // password hardcoded for illustrative purposes 

Nodes results = xquery.execute(doc, null, queryVars).toNodes();

for (int i=0; i &lt;< results.size(); i++) {
  System.out.println(results.get(i).toXML());
}