...
According to XML W3C Recommendation [W3C 2008], section 4.4.3, "Included If Validating":
...
| CERT Perl Coding Standard | IDS33-PL. Sanitize untrusted data passed across a trust boundary |
Injection [RST] | |
CWE-116, Improper encoding or escaping of output |
...
This rule uses MS SQL Server as an example to show a database connection. However, on Android, DatabaseHelper from SQLite is used for a database connection. Because Android apps may receive untrusted data via network connections, the rule is applicable.
Bibliography
A Guide to Building Secure Web Applications and Web Services | |
[W3C 2008] | 4.4.3, "Included If Validating" |
...
Rule 00: Input Validation and Data Sanitization (IDS) Rule 01: Declarations and Initialization (DCL)