Does the Android SQLite implementation sanitize input via the SQLiteDatabase.insert() method?

Question

The SQLiteDataBase.insert(String, String, ContentValues) convenience method takes a ContentValues object which contains all of the column values of a row to be inserted into the database. If I use the ContentValues.put() methods to build a ContentValues object to insert into the database, does either put() or insert() sanitize the input or do I have to do that myself?

Sorry about the bung hyperlinking but it always works in the preview and never in the real post for me... — Sam Svenbjorgchristiensensen
– Sam Svenbjorgchristiensensen, Commented Nov 13, 2010 at 2:44

braveterry · Accepted Answer · 2013-02-12 19:37:40Z

6

Yes, this will protect you from injection. You can see in the source that insertWithOnConflict (which is called by insert) correctly uses ? place-holders in a SQLiteStatement.

edited Feb 12, 2013 at 19:37

braveterry

3,7548 gold badges51 silver badges59 bronze badges

answered Nov 13, 2010 at 2:51

Matthew Flaschen

286k53 gold badges523 silver badges554 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Michael Over a year ago

That link appears to be broken, the page says "Unknown identifier: "android/database/sqlite/SQLiteDatabase.java". Falling back to search"

prolink007 · Accepted Answer · 2010-11-13 02:52:08Z

0

%W will sanitize it with double quotes, but how much sanitation are you wanting?

answered Nov 13, 2010 at 2:52

prolink007

34.7k24 gold badges124 silver badges191 bronze badges

Collectives™ on Stack Overflow

Does the Android SQLite implementation sanitize input via the SQLiteDatabase.insert() method?

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related