Enter malicious strings in input fields to manipulate the XPath query so that it interferes with the application's logic.

Enter malicious strings in input fields to manipulate the XPath query so that it interferes with the application's logic.

• A. XPath Injection
• B. SQL Injection
• C. XML External Entity (XXE)
• D. Cross-Site Scripting

Answer: (A)

This scenario targets altering how an XPath expression is evaluated by the application through user input. XPath injection happens when input is inserted into an XPath query without proper escaping, allowing an attacker to modify the query’s logic and potentially read or manipulate data in an XML store. The description—entering malicious strings in input fields to interfere with the application's logic—directly matches manipulating an XPath query, not SQL, scripts, or external XML entities. For contrast, SQL injection affects SQL queries against databases, cross-site scripting injects scripts into web pages, and XXE abuses how XML processors handle external entities. To defend, validate and escape all input, use safer XPath query construction (prefer parameterization or safe APIs), and apply least-privilege access to the XML data.

This scenario targets altering how an XPath expression is evaluated by the application through user input. XPath injection happens when input is inserted into an XPath query without proper escaping, allowing an attacker to modify the query’s logic and potentially read or manipulate data in an XML store. The description—entering malicious strings in input fields to interfere with the application's logic—directly matches manipulating an XPath query, not SQL, scripts, or external XML entities. For contrast, SQL injection affects SQL queries against databases, cross-site scripting injects scripts into web pages, and XXE abuses how XML processors handle external entities. To defend, validate and escape all input, use safer XPath query construction (prefer parameterization or safe APIs), and apply least-privilege access to the XML data.