Page History

                
import java.io.IOException;
import org.w3c.dom.*;
import org.xml.sax.SAXException;
import javax.xml.parsers.*;
import javax.xml.xpath.*;

public class XpathInjectionExample {

  
       public boolean doLogin(String loginID, String password)
             throws ParserConfigurationException, SAXException,IOException, 
XPathExpressionException {

          DocumentBuilderFactory domFactory = DocumentBuilderFactory.newInstance();
         domFactory.setNamespaceAware(true);
         DocumentBuilder builder = domFactory.newDocumentBuilder();
         Document doc = builder.parse("users.xml");

         XPathFactory factory = XPathFactory.newInstance();
         XPath xpath = factory.newXPath();
         XPathExpression expr = xpath.compile("//users/user[login/text()='" + 
            + loginID +"'" + "and password/text()='"+password+"' ]")";
     Object result = expr.evaluate(doc, XPathConstants.NODESET);
         NodeList nodes = (NodeList) result;
    // print first names to the console 
         for (int i = 0; i < nodes.getLength(); i++) {
             System.out.println(nodes.item(i).getNodeValue());}
         
    
       
    return     if (nodes.getLength() >= 1) {               
              return true;}
              else
             {return false;}
       }
}

Document doc = new Builder().build("users.xml");
XQuery xquery = new XQueryFactory().createXQuery(new File(" 
dologin.xq"));

Map queryVars= new HashMap();

queryVars.put("loginid", "Utah");
queryVars.put("password", "test123");

Nodes results = xquery.execute(doc, null, vars).toNodes();

for (int i=0; i < results.size(); i++) {
    System.out.println(results.get(i).toXML());
}