Bit Functions and Operators Because  ExtractValue()  returns multiple matches as a single space-delimited string, this injection attack provides every valid ID contained within  users.xml  to the user as a single row of output. As an extra safeguard, you should also test output before returning it to the user. Here is a simple example: In general, the guidelines for returning data to users securely are the same as for accepting user input. These can be summed up as: •Always test outgoing data for type and permissible values. •Never permit unauthorized users to view error messages that might provide information about the application that could be used to exploit it. Bit functions and operators comprise  BIT_COUNT() ,  BIT_AND() ,  BIT_OR() ,  BIT_XOR() ,  & ,  | ,  ^ , ~ ,  << , and  >> . (The  BIT_AND() ,  BIT_OR() , and  BIT_XOR()  aggregate functions are described in Section 12.20.1, “Aggregate Function Descriptions” .) Prior to MySQL 8.0, bit functions and operators required  BIGINT  (64-bit integer) arguments and returned  BIGINT  values, so they had a maximum range of 64 bits. Non- BIGINT  arguments were converted to  BIGINT  prior to performing the operation and truncation could occur. 2258 Table 12.17 Bit Functions and Operators 12.13 Bit Functions and Operators | id | +-------------------------------+ | 00327 13579 02403 42354 28570 | +-------------------------------+ 1 row in set (0.01 sec) mysql>  SELECT @id = ExtractValue( -> LOAD_FILE(’users.xml’), -> ’//user[login/text()="" or 1=1 and password/text()="" or 1=1]/attribute::id’ ->  ); Query OK, 0 rows affected (0.00 sec) mysql>  SELECT IF( -> INSTR(@id, ’ ’) = 0, -> @id, -> ’Unable to retrieve user ID’) ->  AS singleID; +----------------------------+ | singleID | +----------------------------+ | Unable to retrieve user ID | +----------------------------+ 1 row in set (0.00 sec) Name Description & Bitwise AND >> Right shift << Left shift ^ Bitwise XOR BIT_COUNT() Return the number of bits that are set | Bitwise OR ~ Bitwise inversion