Signs on the Sand

It's already 2005 and everybody's aware of SQL injection attacks nowadays. But it's silly to think that this kind of attack is only about SQL, right? SQL injection is just one particular case of a general code injection attack when somebody too gullible allows user input to become a part of an executable code. So it's always bother me when I see how often people (even XML geeks) are building XPath expressions concatenating them with user input. Admit it - unfortunately that's common practice - to have something like root.SelectNodes("entry[@id=""" & request.forms("id") & """]")