make the java code not vulnerable to xpath injection: String expression = "/users/user[@name='" + user + "' and @pass='" + pass + "']";