A lot of stuff covered by OWASP applies to applications as the line between desktop app and web app blurs. Things like SQL injection, command injection, object injection to name a few injection attacks. I once tested a .Net MVC app by uploading a PHP file and tried to see if the code was executed or presented as raw text when viewed.
As far as tools you ...
If for some reason you don't like XPath Extractor you can always switch to Regular Expression Extractor, the relevant configuration would be something like:
Reference Name: the same value you use in the XPath Extractor, i.e. id
Regular Expression: <productid>(.+?)</productid>
You can refer it in the JDBC Request like:
SELECT * ...
What's wrong with XPath Extraction? Is there a specific reason you cannot use XPath?
You can use RegEx extractor, but keep in mind you are going to have to build a pretty well structured query to get the right value. XPath anticipates many results and puts them into an index array.
Without more information this question cannot be answered. - Why is that 90%...
I would suggest for any security related testing you start with OWASP:
OWASP have excellent overviews and descriptions as well as concrete guidance on testing and mitigation for most common classes of vulnerability.