How to Prevent SQL Injection in Laravel

The Problem

How to Fix

1. 1

   Use parameterized queries instead of string concatenation

   Never concatenate user input into SQL queries. Replace:

   // VULNERABLE - never do this
   $users = DB::select("SELECT * FROM users WHERE email = '" . $request->email . "'");

   With parameterized binding:

   // SAFE - use parameter binding
   $users = DB::select('SELECT * FROM users WHERE email = ?', [$request->email]);

   // SAFE - use named bindings
   $users = DB::select('SELECT * FROM users WHERE email = :email', ['email' => $request->email]);

2. 2

   Secure raw query methods

   When using whereRaw(), orderByRaw(), or DB::raw(), always use bindings:

   // VULNERABLE
   User::whereRaw("email = '" . $request->email . "'")->first();

   // SAFE
   User::whereRaw('email = ?', [$request->email])->first();

   // VULNERABLE - column names cannot be parameterized
   User::orderByRaw($request->sort_column . ' ' . $request->sort_direction)->get();

   // SAFE - whitelist allowed values
   $column = in_array($request->sort_column, ['name', 'email', 'created_at']) ? $request->sort_column : 'created_at';
   $direction = $request->sort_direction === 'desc' ? 'desc' : 'asc';
   User::orderByRaw("$column $direction")->get();

3. 3

   Validate and sanitize all input

   Use Laravel validation to restrict input before it reaches queries:

   $validated = $request->validate([
       'email' => 'required|email|max:255',
       'id' => 'required|integer',
       'status' => 'required|in:active,inactive,pending',
       'search' => 'nullable|string|max:100',
   ]);

   // Use validated data in queries
   $user = User::where('email', $validated['email'])->first();

   Validation prevents unexpected input types and lengths from reaching your database layer.

4. 4

   Use Eloquent ORM whenever possible

   Eloquent automatically parameterizes all queries:

   // All of these are safe from SQL injection
   User::find($id);
   User::where('email', $email)->first();
   User::where('status', $status)->where('role', $role)->get();
   User::whereBetween('created_at', [$start, $end])->get();

   Avoid raw queries unless Eloquent genuinely cannot express what you need. For complex queries, use the query builder with bindings rather than raw SQL strings.

How to Verify

' OR '1'='1
'; DROP TABLE users; --
1 UNION SELECT * FROM users

Prevention

Frequently Asked Questions