XPath Expressions | The Coffeehouse

System

Hi guys, just a quick question.

Could someone give me some advice on xpath expressions?

I have an xml file which holds a title and a description of some images and using a form view (asp), I would like to display the description of the image based on the title (which I would like to pull from Image1.ImageUrl).

Is this possible? I seem to be having a very brainless day today!

harumscarum
out of memory

Can you post your xml structure?

System

For now, its simply:

<pictures>

</pictures>

Sven Groot
My name has 9 letters. Coincidence? I think not...

To select image1.gif:

/pictures/image[@id='image1.gif']

phreaks

anon wrote:

For now, its simply:

<pictures>

<image id ="image1.gif" title="Title" des="Description"></image>

<image id ="image2.gif" title="Title" des="Description"></image>

</pictures>

/pictures/image[@id='image1.gif']/@des

EDIT:(too slow)

Drats, foiled again!

System

So, could you do something like:

/pictures/image[@id='" + Request.QueryString["id"] +"']

Sven Groot
My name has 9 letters. Coincidence? I think not...

You might want to watch for single quotes in the querystring though, otherwise you'd get XPath injection. Tongue Out Can't think of anything useful you could do with that though.

littleguru
<3 Seattle

Sven Groot wrote:
You might want to watch for single quotes in the querystring though, otherwise you'd get XPath injection. Can't think of anything useful you could do with that though.

There's people having passwords to CMS in XML files (perhaps even the same file where they store settings)... weird, but the truth.

System

littleguru wrote:

Sven Groot wrote: You might want to watch for single quotes in the querystring though, otherwise you'd get XPath injection. Can't think of anything useful you could do with that though.

There's people having passwords to CMS in XML files (perhaps even the same file where they store settings)... weird, but the truth.

Very odd. I wouldnt use it for that!

Right, when I configure the data source for my FromView to display, I put

/pictures/image[@id='Request.QueryString["id"]']

but it doesnt work. Any ideas?

JChung2006

anon wrote:

Right, when I configure the data source for my FromView to display, I put

/pictures/image[@id='Request.QueryString["id"]']

but it doesnt work. Any ideas?

How about string.Format("/pictures/images[@id='{0}']", Request.QueryString["id"])?

Matthew van Eerde
AKA Maurits

XPath injection... interesting.

Can you encode an arbitrary string as an XPath literal?

System

JChung2006 wrote:

anon wrote:
Right, when I configure the data source for my FromView to display, I put

/pictures/image[@id='Request.QueryString["id"]']

but it doesnt work. Any ideas?

How about string.Format("/pictures/images[@id='{0}']", Request.QueryString["id"])?

Now I get an an error about having no namespace manger and that this "query has a prefix, variable, or user-defined function".

I have had a look through http://support.microsoft.com/kb/324462 regarding custom extensions to XPath queries, but it just seems very bloated for something I assumed would be easy. Am I even going about this the right way?

Sven Groot
My name has 9 letters. Coincidence? I think not...

You need a namespace manager only if the query uses a namespace prefix that is not defined in the document. The example document you gave didn't have any namespaces so the query doesn't need any prefixes.

Can you show the exact XPath query you're using (after the ID has been placed in there)?

JChung2006

anon wrote:

JChung2006 wrote:

anon wrote:
Right, when I configure the data source for my FromView to display, I put

/pictures/image[@id='Request.QueryString["id"]']

but it doesnt work. Any ideas?

How about string.Format("/pictures/images[@id='{0}']", Request.QueryString["id"])?

Now I get an an error about having no namespace manger and that this "query has a prefix, variable, or user-defined function".

I have had a look through http://support.microsoft.com/kb/324462 regarding custom extensions to XPath queries, but it just seems very bloated for something I assumed would be easy. Am I even going about this the right way?

Sorry anon, the code that I posted wasn't intended to be used as the XPath expression itself. It was intended to generate the XPath expression in C# codebehind. It sounds like you need a different solution than what I proposed.

System

The xpath expression should be:

/pictures/image[@id='woods']

as woods is passed in as the id.

Now when I place that into the XPath expression field on the configure data source wizard, everything works ok.

However, if I place (what I orginally had):

/pictures/image[@id='Request.QueryString["id"]']

nothing appears in the form view control?

If I put:

string.Format("/picture/image[@id='{0}']", Request.QueryString["id"])

I get the namespace error. I even get this error if I do not pass anything to the page.

System

I decided to go the code route and its working just fine.

I only wanted to do it through the asp control because I thought it would be less time consuming! Oh how I was wrong.