Btukfyl

I'm currently trying to take user input from a text box and build an XML query with it.

The query should search within the document for an element with a given attribute 'dataItemId' and return the innerText value.
The two lines of code which are commented out within the try{} statement work as expected, returning the correct value, yet when I try to use the two lines above these and type 'Xabs' into my input box I am getting:

Your resultant Query XPath: //*[dataItemId = 'Xabs']
No Items Found."

It must be something to do with how the string is parsed but I'm stumped as to what.

public void MazakButton_Click(object sender, EventArgs e)

    {

        string userInput = searchInput.Text;

        ResultBox.Items.Clear();

        string query = "No Query Found";

        string searchResult = "No Items Found";



        if (userInput.Length > 3)// If query paramater is long enough

        {                

            //string Query = ""//*[dataItemId = '" + userInput + "']""; // Build Attribite Query

                query = "//*[dataItemId = '" + userInput + "']"; // Build Attribite Query

            XmlDocument MTData = MTFunctions.ScrapeXMLData(MazakSourceURL, false);



            try

            {

                XmlNode target = MTData.SelectSingleNode(query);

                searchResult = userInput + ": " + target.InnerText;

                //XmlNode target = MTData.SelectSingleNode("//*[@dataItemId = 'Xabs']"); 

                //searchResult = target.InnerText;

            }

            catch

            {

                Console.WriteLine("!!!!!!!!!!!!!!! - XML SEARCH FAILED - !!!!!!!!!!!!!!!");

            }

        }

        else{searchResult = "Invalid request (Too short)";}





        searchInput.Focus();

        ResultBox.Items.Add("Your Resultant Query XPath: " + query);

        ResultBox.Items.Add(searchResult);

        searchInput.Text = string.Empty; // Clear searchInput 

    }

First point: you should never build a query by string concatenation incorporating user input. Google "SQL injection attacks" to find out why (most of the literature is in SQL terms, but XPath has exactly the same vulnerabilities).

If you use an expression with a variable, like //*[dataItemId = $userInput] then (a) you are protected against injection attacks, (b) you don't need to worry about escaping special characters in the input (like apostrophes), and (c) it's much more efficient because you only need to compile the XPath expression once.

The only difficulty is that you need to work out how to supply a parameter to the query (that is, a value for $userInput) before executing it. That depends on the API to your XPath processor and I'm not familiar with the XPath processor that you are using, so you'll need to research this yourself.