Does SQLiteDatabase.insert() prevent SQL injection attacks?

Question

I've checked the documentation, but I didn't see it address SQL injections. Does the insert() method automatically prevent injections, or must they be prevented manually? Thanks.

I think insert() is safe. It's parameterized at least. I don't see how injection is possible with it. But don't take my word for it. — keyser
– keyser, Commented Jul 31, 2013 at 19:55
That's what I imagined, but it would be more reassuring to find some confirmation one way or another, especially when dealing with vulnerabilities. — cheese1756
– cheese1756, Commented Jul 31, 2013 at 19:57
If in doubt you can check out the Android source code. Calling insert does create a parameterized query with questionmark placeholders (see SQLIteDatabase.java -> insertWithOnConflict), so yes it should be safe. — tiguchi
– tiguchi, Commented Jul 31, 2013 at 19:57

sassospicco · Accepted Answer · 2013-10-29 15:27:34Z

3

Android API calls SQLite native library to bind parameters. So, assuming the prepared statements are correctly written, queries are safe.

Relevant source code:

answered Oct 29, 2013 at 15:27

sassospicco

781 silver badge7 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Does SQLiteDatabase.insert() prevent SQL injection attacks?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related