XPath variables in lxml
问题 I want to use XPath variables to match a user-defined tag and avoid XPath injection vulnerabilities. I have tried from lxml import etree etree.fromstring('<div><p>Hello</p></div>').xpath('.//$var', var='p') but I get XPathEvalError: Invalid expression What am I doing wrong? 回答1: You cannot use a variable as the node test part of a location step in an expression. It has to be a literal name. But you can use a wildcard and a predicate. The following works: etree.fromstring('<div><p>Hello</p><