Home/ Questions/Q 8307937
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T18:39:10+00:00

Does Android’s ContentValues when used with database.insert() automatically escape content? Example: String message =

  • 0

Does Android’s ContentValues when used with database.insert() automatically escape content?

Example:

String message = "This is a sample that doesn't have a single quote";

ContentValues values = new ContentValues();
values.put(DBManagement.MESSAGE, message);
values.put(DBManagement.TIME, (int) (System.currentTimeMillis()/1000));
database.insert(DBManagement.TABLE_NAME, null, values);

It looks like it is automatically escaped at times but not others.

YI, I use rawQuery and parametrize the input to escape and protect against injection in other queries.

What is the deal?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Fixed the issue. For some reason, I had to increase the database version in order to resolve the problem. Once done, the newer DB no longer had an issue.

    Also, yes, ContentValues is supposed to escape your content.

    • 0