Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

<?php
// Laravel Eloquent — safe by default, dangerous raw escapes

use App\Models\User;
use Illuminate\Support\Facades\DB;

// SAFE: Eloquent query builder — parameterised automatically
$users = User::where('username', $username)
             ->where('active', true)
             ->get();

// SAFE: query builder with whereIn
$ids   = [1, 2, 3];
$users = User::whereIn('id', $ids)->get();

// DANGEROUS: raw DB statement with interpolation — avoid
// DB::statement("DELETE FROM users WHERE id = $id");  // BAD

// SAFE: raw statement with bindings
DB::statement('UPDATE users SET login_at = NOW() WHERE id = ?', [$userId]);

// SAFE: raw select with bindings
$results = DB::select(
    'SELECT * FROM audit_log WHERE user_id = ? AND action = ?',
    [$userId, $action]
);

// Stored procedure (MySQL) — parameterised internally
/*
CREATE PROCEDURE GetUserByUsername(IN p_username VARCHAR(255))
BEGIN
    -- Uses parameter, not concatenation — safe
    SELECT id, email FROM users WHERE username = p_username AND active = 1;
END;
*/

// Call stored procedure via PDO
$stmt = $pdo->prepare('CALL GetUserByUsername(:username)');
$stmt->execute(['username' => $username]);
$user = $stmt->fetch();