Discuss XML I10-003 Exam Topic 5 Question 80

See separate window.

A certain Web application displays user information according to user input via Web browser. The XML data managing user information is as shown in [example.xml] (separate window). The following [XQuery] is executed when the Web application retrieves user information from [example xml].

[XQuery]

{

fn:doc("example.xml")//data[userid = "(1)"][password = "(2)"]

}

At this time, the Web application completes the [XQuery] by replacing (1) and (2) with the user input character string, and executes the query.

No character escapes (e.g. convert "<" to "<") are performed for character string input by the user. Select two of the following that produces the query execution result in [Execution Result] (separate window) when the character string is as shown in each answer choice.

A(1) ' or''='
(2) OK

B(1) ' or''='
(2) ' or''='

C(1) idorfn:true()
(2) OK

D(1) idorfn.true()
(2) idorfn:true()

E(1) ' or fn:true() or any='
(2) OK

F(1) 'or fn:true() or any='
(2) 'or fn:true() or any='

Suggested Answer: B, F

Get Premium I10-003 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

23 comments · newest first

Vicki 3 days ago

I think option A could work.

Marti 8 days ago

I feel the same.

Vicki 13 days ago

This question is tricky!

Colette 18 days ago

Same here!

Leanna 24 days ago

I just hope I pick the right ones!

Corinne 29 days ago

True, it could break the query.

Colette 1 month ago

F might not return the right result.

Leanna 1 month ago

What about F?

Corinne 1 month ago

E is interesting!

Colette 2 months ago

I’m leaning towards E.

Corinne 2 months ago

A makes sense, but B looks good too.

Leanna 2 months ago

I think option A could work.

Corinne 2 months ago

I feel the same.

Leanna 2 months ago

This question is tricky!

Gladis 3 months ago

I think E is also a valid option, right?

Dyan 3 months ago

C and D won't work, they don't match the expected format.

Belen 3 months ago

Wait, can you really use "or""=" like that? Seems sketchy.

Dyan 3 months ago

Totally agree, those inputs exploit the query!

Thea 3 months ago

A) and B) will definitely work!

Omer 3 months ago

I’m a bit confused about the difference between options C and D. They both seem to involve function calls, but I can't recall which one would execute correctly.

Margart 4 months ago

I feel like I’ve seen something similar with the "or" statements before. I wonder if option E would actually return the expected results.

Pok 4 months ago

I think option B looks familiar from our practice questions. It seems like it could exploit the query, but I’m not entirely confident about the syntax.

Goldie 4 months ago

I remember we discussed how user input can lead to SQL injection-like vulnerabilities in XQuery. I'm not sure if the first option would work, though.

XML I10-003 Exam - Topic 5 Question 80 Discussion