title: What is the best way to avoid XPath Injection attack in Java?
body: <p>I am using XPath to retrieve values from XML.  My code scanner break the build because of the following reason:</p>
  
  <blockquote>
    <p>invokes an XPath query built using unvalidated input. This call could
    allow an attacker to modify the statement's meaning or to</p>
  </blockquote>
  
  <p>This is my code:</p>
  
  <pre><code>private String myMethod(String XPath, OMElement input) {
    String elementText = null;
    AXIOMXPath xpathToElement = null;
    try {
      xpathToElement = new AXIOMXPath(XPath);
      xpathToElement.addNamespace(xxx,yyy);
      elementText = ((OMElement) xpathToElementnode.selectSingleNode(input)).getText();
  
    } catch (JaxenException e) {
      e.printStackTrace();
      fail(e.getMessage());
    ...
  </code></pre>
  
  <p>Here is the code where I call above method:</p>
  
  <pre><code>key = myMethod(myAttribute.getAttributeValue(), input);
  </code></pre>
  
  <p><code>input</code> is <code>OMelement</code> which contains XML. Attribute is getting from XML attribute.</p>
  
  <p>How can I avoid XPathInjection?  Could please share a code snippet?</p>