Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

onujaar's avatar

Is this an SQL injection bug or am I using param binding wrong in MATCH AGAINST raw query

DB::select('SELECT * FROM answers WHERE MATCH(search_terms) AGAINST( :term IN BOOLEAN MODE)', ['term' => $term]);

It seems parameter is not escaped with this query (closing parenthesis breaks query). Is this an SQL injection bug or am I using parameter binding wrong in this raw SQL.

Laravel: 5.8.36 MySQL: 8 PHP: 7.3

Parameter binding should offer protection against SQL injection: https://laravel.com/docs/5.8/database#running-queries

//edit:

Same issue when using parameter binding by position/index (with ? symbol)

0 likes
2 replies

Please or to participate in this conversation.