XOM API for Processing XML with Java

[Elliotte Harold <elharo AT metalab.unc.edu>]

Jeff Williams wrote:

> Have you looked?  XPath code that takes user input is just as likely to
> be vulnerable to injection as SQL code that takes user input. I found it
> in a customer's application just last week.

I just don't see a lot (or any) XPath code that takes user input. I'd 
love to hear details about any real world cases you've encountered 
though. I do see lots of SQL code that takes user input.

Perhaps this will change if native XML databases become as prevalent as 
I expect over the next couple of years.

--
Elliotte Rusty Harold  elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/