Protecting Against SQL Injection in Modern PHP: Prepared Statements, Raw Queries, and ORM Edge Cases

The Myth That ORMs Guarantee 100% SQL Injection Immunity

While ORMs like Eloquent and Doctrine protect standard CRUD operations through parameter binding, vulnerabilities emerge whenever developers concatenate user inputs into raw query fragments: whereRaw(), orderByRaw(), or direct PDO statements.

Safe vs Dangerous Patterns

// DANGEROUS: Susceptible to second-order SQL injection
DB::select("SELECT * FROM items ORDER BY " . $request->input('sort'));

// SAFE: Whitelisted sorting and parameter binding
$allowed = ['price', 'created_at', 'name'];
$sort = in_array($request->input('sort'), $allowed) ? $request->input('sort') : 'created_at';
DB::table('items')->orderBy($sort)->get();