//user[name='' or '1'='1']
<r><user><name>a</name></user></r>