https://rifco.ru/blog/2017/02/08/xpath-injection-attack/
XPath Injection Attack