XPath injection example