Laravel query builder: is this command excused from SQL injections? - sql

Question

Some time ago I've read here on Stackoverflow an accepted answer which was claiming that select("sql query") is excused from SQL injection, while select(raw("sql query")) isn't. In my case I have the following code:
$request; // Illuminate\Http\Request
DB::connection('default')->select("
SELECT *
FROM `some_table`
WHERE `some_col` = '$request->some_val'
");
Is that command excused from SQL injection? If yes, I can't understand how does query builder knows how to prepare the statement? :thinking:

Answer 1

For not permit sql injection You must be use this code
DB::::connection('default')
->select('SELECT * FROM `some_table` WHERE `some_col` = ?', [$request->some_val]);

Answer 2

You should use:
DB::connection('default')->select("
SELECT *
FROM `some_table`
WHERE `some_col` = ?
", [$request->some_val]);
to avoid SQL injection.
You can read:
Parameter binding provides protection against SQL injection.
on documentation page.
If you execute SQL queries as you shown in your question that you might suffer from SQL injection.

Answer 3

The Laravel query builder uses PDO parameter binding to protect your application against SQL injection attacks. There is no need to clean strings being passed as bindings.
You can refer to below links:
Laravel Eloquent: is SQL injection prevention done automatically?
https://laravel.com/docs/5.6/queries#introduction