XPath injection (ARCH7108)

Key php.security.xpath-injection · Severity error · Category security · CWE CWE-643

Concatenating user input into an XPath expression lets attackers alter the query to bypass authentication or disclose other data in the document. Input must be passed as bound variables.

Incorrect

<?php
$xpath = new DOMXPath($dom);
$user = $_POST['user'];
$nodes = $xpath->query("//user[name='$user']");

Correct

<?php
$xpath = new DOMXPath($dom);
$result = $xpath->evaluate(
    '//user[name = $name]',
    null,
    ['name' => $_POST['user']]
);

Fix

Do not concatenate user input into the XPath expression; pass values as bound variables or strictly escape them.