title: Android user input sanitization for web service call
body: <p>I'm fairly new to Android programming, so this may be a simple question, but I haven't found the answer yet. 
  Basically, I'm calling a C# webservice that expects xml. I'm leery of sending unfiltered user input. There are quite a few places where I have to do this, but the login is a good example:</p>
  
  <p>Here's a rough version of what I've currently got (cobbled together from other SO examples):</p>
  
  <pre><code>String userName = "MyUserName";
  String password= "MyPassword";
  String url = "http://mywebserviceurl.com/auth;
  String xml = "&lt;AuthenticateModel xmlns=\"http://schemas.datacontract.org/2004/07/Mycompany.Auth.Lib\"&gt;\n" +
              "  &lt;EmailAddress&gt;" + userName + "&lt;/EmailAddress&gt;\n" +
              "  &lt;EncodedPassword&gt;" + password + "&lt;/EncodedPassword&gt;\n" +
              "&lt;/AuthenticateModel&gt;";
  
  HttpClient httpclient = new DefaultHttpClient();
  HttpPost post = new HttpPost(url);
  StringEntity str = new StringEntity(xml);
  str.setContentType("application/xml; charset=utf-8");
  str.setContentEncoding(new BasicHeader(HTTP.CONTENT_TYPE,"application/xml; charset=utf-8"));
  post.setEntity(str);
  HttpResponse httpResponse = httpclient.execute(post);
  </code></pre>
  
  <p>It works great. The user info is handled on the server side, but it sure seems like a bad idea to send it completely unfiltered. I'd appreciate the feedback. </p>
  
  <p>Additionally: I store the username in the application preferences, so it's not just the webservice that I am concerned about.
  Thanks!</p>