Sanitizing DB inputs with XSLT

Question

Hello

I've been looking for a method to strip my XML content of apostrophes (') since my DBMS is complaining of receiving those.

I need

<name> Jim O'Connor</name>

to become:

<name> Jim O''Connor</name>

By looking at the example described here, that is supposed to replace ' with '', I constructed the following script:

    <xsl:stylesheet version="1.0"
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"&gt;
      <xsl:output omit-xml-declaration="yes" indent="yes" />

      <xsl:template match="node()|@*">
        <xsl:copy>
          <xsl:apply-templates select="node()|@*" />
        </xsl:copy>
      </xsl:template>

      <xsl:template name="sqlApostrophe">
        <xsl:param name="string" />
        <xsl:variable name="apostrophe">'</xsl:variable>
        <xsl:choose>
          <xsl:when test="contains($string,$apostrophe)">
            <xsl:value-of select="concat(substring-before($string,$apostrophe), $apostrophe,$apostrophe)"
            disable-output-escaping="yes" />
            <xsl:call-template name="sqlApostrophe">
              <xsl:with-param name="string"
              select="substring-after($string,$apostrophe)" />
            </xsl:call-template>
          </xsl:when>
          <xsl:otherwise>
            <xsl:value-of select="$string"
            disable-output-escaping="yes" />
          </xsl:otherwise>
        </xsl:choose>
      </xsl:template>

      <xsl:template match="text()">
        <xsl:call-template name="sqlApostrophe">
          <xsl:with-param name="string" select="."/>
        </xsl:call-template>
      </xsl:template>

    </xsl:stylesheet>

UPDATE: it works fine

Thanks for your help

Answer 1

You have a couple of issues syntactically...

1. You can't have a name attribute on an apply-templates tag.
2. Your xpath, "node()|@*", is ambiguous.

Have you run this through a debugger? I would suggest Oxygen.

Answer 2

The main problem is in your last template. As dacracot points out, xsl:apply-templates does not take a name attribute. To call a named template, you'd use xsl:call-template.

If you want to apply your SQL escaping to all text nodes, you could try replacing your last template with something like this:

<xsl:template match="text()">
  <xsl:call-template name="sqlApostrophe">
    <xsl:with-param name="string" select="."/>
  </xsl:call-template>
</xsl:template>

Also, why disable-output-escaping? If the text contains special characters (<, >, &), you'll get malformed XML as the output.

Answer 3

Is there a reason to call a separate template to do the replacement? What processor are you using? You should be able do the replacement in the match="text()" template.

This works for me using Saxon 9-HE:

Input XML:

<?xml version="1.0" encoding="UTF-8"?>
<name> Jim O'Connor</name>

Stylesheet:

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"&gt;
   <xsl:output indent="yes"/>

   <xsl:template match="element()|@*">
      <xsl:copy>
         <xsl:apply-templates select="node()|@*"/>
      </xsl:copy>
   </xsl:template>

    <xsl:template match="text()">
        <xsl:value-of select="replace(data(.),'''','''''')"/>
    </xsl:template>

</xsl:stylesheet>

Output XML:

<?xml version="1.0" encoding="UTF-8"?>
<name> Jim O''Connor</name>