How use multiple conditions in xpath query?

Question

 $elements = $xpath->query(
   "//message[(@sender ='".$from." and @receiver = '".$username."') or
   (@receiver='unread' and @sender = '".$username."')]"
  );

Whats the problem with this code? I need something like this SELECT data WHERE ((sender == from AND receiver = username)OR(sender == username AND receiver = from)) from my xml file

Gordon · Accepted Answer · 2012-09-24 06:56:50Z

4

Use sprintf instead. It's less messy and errors are more easy to spot.

$query = sprintf(
    '//message[
        (@sender = "%1$s" and @receiver = "%2$s") or
        (@receiver="unread" and @sender = "%2$s")
    ]',
    $from,
    $receiver
);

Also, make sure to sanitize $from and $receiver to prevent XPath Injection attacks.

answered Sep 24, 2012 at 6:56

Gordon

318k76 gold badges548 silver badges566 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Wayne · Accepted Answer · 2012-09-24 06:48:18Z

2

You're missing a closing single quote after this portion:

(@sender ='".$from."

There's nothing wrong with your general approach.

answered Sep 24, 2012 at 6:48

Wayne

60.5k15 gold badges135 silver badges129 bronze badges

2 Comments

EbinPaulose Over a year ago

thanks.. i wasted two hours by analyzing this error and failed to debug

Wayne Over a year ago

@EbinPaulose - It's an easy mistake to make. It's a good idea to print out the constructed value early on (or use sprintf as others have suggested). It makes errors easier to spot.

Michael Kay · Accepted Answer · 2012-09-24 08:06:36Z

1

One of the problems with your code is that you're exposing yourself to injection attacks. Do you really trust $from and $username to be simple strings? Rather than building a query using string concatenation, it's much safer (and faster) to set up a parameterized query in which the parameters are supplied externally. I've no idea if the PHP API you are using allows you to do that.

answered Sep 24, 2012 at 8:06

Michael Kay

165k11 gold badges97 silver badges173 bronze badges

1 Comment

Gordon Over a year ago

unfortunately, none of the native XML APIs in PHP allow parameterized queries. There is a couple of 3rd party libs though, which compensate with their own implementations.

Collectives™ on Stack Overflow

How use multiple conditions in xpath query?

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related