An XML injection attack is where untrusted input is placed into an XML document or query and changes what it means. The attacker’s text stops being plain data and turns into XML markup or logic. They might insert a new tag like <isAdmin>true</isAdmin>, change a value, or close an element early and add their own content. It shows up in systems that use XML to carry instructions or identity, such as SOAP APIs, SAML logins, device configs and admin tools. A related case is XPath or XQuery injection, where input slips into a query like //user[username='$u' and password='$p'] and lets an attacker read or match data they should not. This is not the same as XXE, which abuses external entities in the parser. XML injection happens because code builds XML with string joins and trusts raw input. The fix is to treat input as data: use real XML builders, escape special characters like <, >, &, ' and ", validate against a schema, and use parameterised queries for XPath or XQuery.
