title: Is this Android SQL statement vulnerable to SQL injection?
body: <p>Is the <code>query()</code> method provided by <code>SQLiteDatabase</code> class safe to use without worrying about SQL injections?</p>
  
  <pre><code>db.query(TABLE,cols,COL_ID + " = '" + id + "' AND " + COL_FROM + " = '" + from + "'",null,null,null,null);
  </code></pre>
  
  <p>The <code>id</code> and <code>from</code> variables are completely unescaped.</p>
  
  <p>Or is the following the only safe way to go?</p>
  
  <pre><code>"column=? OR column2=?", 
        new String[] {"value1", "value2"}
  </code></pre>