SQL injection in XML

It is generally known that most of the XML will cause external entity injection, but XML will also appear SQL injection;

There are two types of normal SQL statements in XML:

First:

<select id= "Selectbyid" resulttype= "Bean.user" >

SELECT * from users where id = #id #</select>

Second:

<select id= "Selectbyid" resulttype= "Bean.user" >

SELECT * from users where id = ' $id $ ' </select>

When using the first notation, the value of the ID is injected into the SQL statement as a parameter, similar to precompilation;

However, when using the second notation, the ID value is inserted directly into the SQL statement as a string, which can easily lead to SQL injection.

SQL injection in XML