Search code examples
xpathxqueryexist-db

variable in xpath

I'm writing xquery on eXist.

Usually I use this way to select item in xml:

fn:doc($document_name)/root/a

But now I wants to get the xpath from a string variable:

let $xpath := request:get-parameter("xpath", "")
fn:doc($document_name)/$xpath

Of course it doesn't work. The only way I found now is using eval:

util:eval(fn:concat("fn:doc($document_name)", $xpath)):)

but i don't want to use eval because it's slow and not safe.

I know there's something like:

fn:doc($document_name)/*[name()='node_name']

but I want to select item via the whole path but not only the name of node and I also have tried to use node-xpath() but don't know how to use it just like name()

Solution

  • You want to do what the eval() function does, so any solution is going to have the same problems as eval. The other approach you could consider is generating a query and then executing it, but it will have exactly the same problems. If you think it might be safer to restrict the string to a subset of XPath expressions (e.g. with no predicates, or no function calls) then you could try testing for those conditions using simple regular expressions.