Servlet API provides a convenient way to set cookies:
response.addCookie(new Cookie(name, value))
JavaDoc tells:
With Version 0 cookies, values should not contain white space, brackets, parentheses, equals signs, commas, double quotes, slashes, question marks, at signs, colons, and semicolons. Empty values may not behave the same way on all browsers.
However it doesn't tell what happens if these characters are present in the value.
If value comes from untrusted source, may I use the API to safely set the value without extra pre-processing or do I open the door for some kind of injection?