adding php variable into Xpath

Question

i just need to add in a variable into the xpath my code is as followed

$target = $xml->xpath('//gig[@id=$1]');

but I need it too but something like

$target = $xml->xpath("//gig[@id=$" $change . "]");

Is this possible ?

If so could some one help ?

What is the question? You provided (except for the missing . typo) the solution yourself. — Veger
– Veger, Commented Jan 21, 2010 at 13:02

Adnan · Accepted Answer · 2010-01-21 12:40:25Z

6

Use:

$target = $xml->xpath("//gig[@id=$". $change . "]");

or, if you do not need the $ sign

$target = $xml->xpath("//gig[@id=". $change . "]");

If you need to escape a character like " in php use

\"

answered Jan 21, 2010 at 12:40

Adnan

26.4k18 gold badges83 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

$target = $xml->xpath("//gig[@id='{$change}']") is also valid.

Note that unless the content of $change is known, the above code is prone to injections. An attacker can cause arbitrary nodes to be returned (

$change = "some_nonsensical_id'] | a malicious xpath | //some_nonsensical_element_name[@some_nonsensical_attribute_name='"

).

@Witiko Isn't that the same for the premise in general, interpolating a variable in a string? It is a genuine question I don't claim to know

Not every string is an SQL command. If you are constructing a string containing natural language text, you may not care too much.