|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2010-05-10 18:43 UTC] pecoes at gmail dot com
Description:
------------
There seems to be no way to escape single or double quotes for XPath-Queries.
given: <test>"</test>
/test[text()="\""] produces an error message
/test[text()="\\""] dito
/test[text()="""] finds no match
This is not a PHP-Bug, I suppose. It may be a bug in the libxml2. It might even be a bug in the XPath Spec itself. But regardless of where the blame lies: This is serious! How is one supposed to use user-input in an XPath, if it cannot be escaped?
I found a work-around, but it's fugly:
$dom = new DOMDocument;
$dom->loadXML('<test>"</test>');
$xpath = new DOMXPath($dom);
function xquote ($str)
{
if (strpos($str, '"') === FALSE) {
return '"'.$str.'"';
}
if (strpos($str, "'") === FALSE) {
return "'".$str."'";
}
$parts = preg_split('/(")/', $str, 0, PREG_SPLIT_DELIM_CAPTURE|PREG_SPLIT_NO_EMPTY);
array_walk($parts,
function (&$val) {
if ($val == '"') $val = "'\"'";
else $val = '"'.$val.'"';
}
);
return 'concat('.implode(',', $parts).')';
}
$q = sprintf('/test[text()=%s]', xquote('"'));
if ($xpath->evaluate($q)->item(0)) {
echo 'found'; // works!
} else {
echo 'not found';
}
Test script:
---------------
$dom = new DOMDocument;
$dom->loadXML('<test>"</test>');
$xpath = new DOMXPath($dom);
$q = '/test[text()="""]';
if ($xpath->evaluate($q)->item(0)) {
echo "found\r\n";
} else {
echo "not found\r\n";
}
$q = '/test[text()="\\""]';
if ($xpath->evaluate($q)->item(0)) {
echo "found\r\n";
} else {
echo "not found\r\n";
}
Expected result:
----------------
found
found
Actual result:
--------------
not found
Warning: DOMXPath::evaluate(): Invalid predicate...
Warning: DOMXPath::evaluate(): Invalid expression...
Fatal error: Call to a member function item() on non-object...
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Oct 29 03:00:01 2025 UTC |
simplest way is to use php functions for comparison, like compare htmlspecialchars escaped strings: $dom = new DOMDocument; $domstr = "<test>double quote: \", single quote: '</test>"; $dom->loadXML($domstr); $xpath = new DOMXPath($dom); $xpath->registerNamespace("php", "http://php.net/xpath"); $xpath->registerPHPFunctions(); $check_string = htmlspecialchars("double quote: \", single quote: '", ENT_QUOTES ); $q = "/test[php:functionString('htmlspecialchars', ., 3) = '$check_string']"; echo $q."\n"; if ($xpath->evaluate($q)->item(0)) { echo "found\r\n"; } else { echo "not found\r\n"; } There is no current plan to support XPath 2.0 although possibility of supporting xpath variables in a future PHP version