input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement

input : direct user input in string filtering : remove semi-colon and all invalid filenames and chars in paths sink : XPATH prepared exec_query : xpath prepared statement