Custom Web Publishing Guide

Developing FileMaker XSLT stylesheets 51
Using statically defined query commands and query parameters
You can prevent the unauthorized use of query commands and query parameters with your FileMaker XSLT
stylesheet by statically defining the query commands and parameters that you want to use when XML data is
requested. Although not required, if any query commands and parameters are statically defined in a stylesheet,
they take precedence over any matching query command or parameters that a client may attempt to specify in
the URL query string.
The stylesheets generated by the Site Assistant and CDML Converter tools use statically defined query
commands and parameters. FileMaker recommends using statically defined query commands and parameters
as a best practice technique for enhancing the security of your solution.
To statically define query commands and parameters, use the following processing instruction at the beginning
of your FileMaker XSLT stylesheet:
<?xslt-cwp-query params="query string-fragment"?>
where:
query string-fragment is a string that contains the name-value pairs in the following format:
name=value&name2=value2....
where:
name is a string that is the name of a query command, query parameter, or database field.
value is an arbitrary length string value. For query parameters and field names, use the particular value you
want to define, such as “–db=products”. For query commands, don’t specify an “=” sign or a value after the
command name, such as –findall. See
appendix A, “Valid names used in query strings.”
The strings used in the fragment must be URL encoded. See “About URL text encoding” on page 25.You must
use the same character encoding that is specified by the encoding attribute in the <xsl:output> tag. If no
encoding is specified, then the Web Publishing Engine uses its configured default encoding.
The separator between two name value pairs must be an ampersand (&).
For example, suppose you used the following processing instruction in a stylesheet named my_stylesheet.xsl:
<?xslt-cwp-query params="-db=products&-lay=sales&-grammar=fmresultset&productname=the%20item&-find"?>
This example processing instruction would force all requests for the my_stylesheet.xsl to use the fmresultset
grammar with the products database and the sales layout, and do a –find request with the productname field
set to the value “the%20item”.
If a client made the following request using my_stylesheet.xsl:
http://server.company.com/fmi/xsl/my_stylesheet.xsl?-lay=revenue&city=London&-edit
then the Web Publishing Engine would process the following XML request:
http://server.company.com/fmi/xml/fmresultset.xml?-db=products&-lay=sales&productname=the%20item&city=London
&-find
The statically defined query command and parameters override the –lay=revenue query parameter and the
–edit query command provided by the client. Because the city field was not statically defined in the processing
instruction, the Web Publishing Engine includes in the XML request the value of “London” for the city field
that the client provided.