XML I10-003 Exam - Topic 6 Question 69 Discussion

Actual exam question for XML's I10-003 exam

Question #: 69
Topic #: 6

See separate window.

A certain Web application displays user information according to user input via Web browser. The XML data managing user information is as shown in [example.xml] (separate window). The following [XQuery] is executed when the Web application retrieves user information from [example xml].

[XQuery]

{

fn:doc("example.xml")//data[userid = "(1)"][password = "(2)"]

}

At this time, the Web application completes the [XQuery] by replacing (1) and (2) with the user input character string, and executes the query.

No character escapes (e.g. convert "<" to "<") are performed for character string input by the user. Select two of the following that produces the query execution result in [Execution Result] (separate window) when the character string is as shown in each answer choice.

A(1) ' or''='
(2) OK

B(1) ' or''='
(2) ' or''='

C(1) idorfn:true()
(2) OK

D(1) idorfn.true()
(2) idorfn:true()

E(1) ' or fn:true() or any='
(2) OK

F(1) 'or fn:true() or any='
(2) 'or fn:true() or any='

Show Suggested Answer

Suggested Answer: B, F

by Brandon at Nov 22, 2025, 06:21 PM

Limited Time Offer

25%

Off

Get Premium I10-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Genevive

10 days ago

Wait, can you really use "or""=" like that?

upvoted 0 times

...

Monroe

15 days ago

Hmm, I'm not sure if I should be impressed or concerned by these answers. Definitely going with B or F though.

upvoted 0 times

...

Essie

21 days ago

Haha, "idorfn:true()" - that's a creative attempt, but I think B and F are the real winners here.

upvoted 0 times

...

Mira

26 days ago

Yikes, that's a pretty serious security flaw. I'd go with B or F to demonstrate the issue.

upvoted 0 times

...

Precious

1 month ago

This is a classic SQL injection vulnerability. Choices B and F look like they could exploit it.

upvoted 0 times

...

Derick

1 month ago

I vaguely remember that using "or" in the input could bypass checks, but I’m not confident about which specific combinations would yield the desired result.

upvoted 0 times

...

Rebbeca

1 month ago

I feel uncertain about option E. It seems like it might work, but I can't recall if the syntax is correct for XQuery.

upvoted 0 times

...

Lai

2 months ago

I think options A and B are similar to practice questions we did on injection attacks. They seem like they could manipulate the query effectively.

upvoted 0 times

...

Chau

2 months ago

I remember we discussed how user input can lead to SQL injection-like vulnerabilities in XQuery. I'm not sure which options would actually execute correctly though.

upvoted 0 times

...

Chu

2 months ago

This is a tricky one, but I think I have a strategy. I'll try some input strings that leverage logical operators and built-in functions to bypass the authentication check.

upvoted 0 times

...

Chauncey

2 months ago

I'm not too familiar with XQuery, but I can see how this could be a security issue if the user input isn't properly validated. I'll need to be careful with my approach and test a few different options.

upvoted 0 times

...

Jonelle

2 months ago

Okay, I think I've got this. The key is to find an input string that will evaluate to true and return the entire dataset, regardless of the actual user ID and password.

upvoted 0 times

...

Antione

2 months ago

Totally agree, those inputs exploit the query!

upvoted 0 times

...

Carmelina

3 months ago

A) and B) will definitely work!

upvoted 0 times

...

Marilynn

3 months ago

Ooh, this is a juicy one! I'm gonna go with the classic B and F - can't beat the classics, am I right?

upvoted 0 times

...

Zoila

3 months ago

Hmm, I'm a bit confused by the XQuery syntax here. I'll need to review my notes on XPath and XQuery to make sure I understand how to properly construct the malicious input.

upvoted 0 times

...

Rachael

4 months ago

This looks like a classic SQL injection vulnerability question. I'd focus on trying different input strings that could potentially exploit the lack of input sanitization.

upvoted 0 times

Samira

3 months ago

This is definitely an injection test.

upvoted 0 times

...

Glendora

3 months ago

A and E seem like good candidates too.

upvoted 0 times

...