Question 1

What is XPath injection?

Accepted Answer

XPath injection occurs when an application builds an XPath query by concatenating untrusted input — for example //user[username='INPUT' and password='INPUT']. By injecting XPath syntax like ' or '1'='1, an attacker changes the meaning of the predicate, making it always true and bypassing authentication or extracting data from the XML document.

Question 2

How is it like SQL injection?

Accepted Answer

The mechanics mirror SQL injection: user input breaks out of a string literal and injects operators (or, and, position()) that alter the query logic. The difference is the query language and data store — XPath querying an XML document instead of SQL querying a relational database — but the root cause, string concatenation of untrusted input, is identical.

Question 3

How do I prevent XPath injection?

Accepted Answer

Bind user values as XPath variables (for example $username via an XPathVariableResolver) instead of concatenating them, or strictly escape/reject quote characters. Better still, don't store credentials in queryable XML — verify passwords against a hashed value in a proper store so a bypassed predicate can't leak secrets.

XPath Injection

Challenges

Frequently Asked Questions