php - Escaping input for insertion into XQuery string -

say have following code:

let $search := "placeholder" ... ...functx:get-matches-and-non-matches($t,$search)... 

this code stored in file, gets loaded string (by php), placeholder gets replaced user input, , code gets executed.

obviously, " needs escaped somehow.

is there other stuff needs escaped or removed before user input safe?

so far, discovered need replace " " stuff work, , in process discovered \ needs \\ here (or \\, makes "\\\\" in php) , escaping { , } might idea, because make regex parser throw otherwise.

don't dynamically construct queries if don't have to, you'll have put lots of effort escaping prevent code injections (and still might overlook parameter somewhere). consider using externally bound variables instead, can compared prepared statements in sql.

as seem use basex , php, example basex php binding:

// create query instance $input = 'declare variable $name external; $i in 1 10 return element { $name } { $i }'; $query = $session->query($input); // bind variable $query->bind("name", "number"); // print results print $query->execute()."\n"; 

if you're using interface basex, registering external variables should possible of them. other xquery implementations should provide similar mechanics bind variables, external variables officially xquery standard.