Description

Detects potential SQL injection vulnerabilities in Laravel PHP applications where unsanitized user input is used in raw SQL queries. This can allow attackers to manipulate database queries and potentially access, modify or delete sensitive data through SQL injection attacks.

Detection Strategy

• Identifies calls to Laravel database methods that accept raw SQL (like DB::raw, selectRaw)

• Checks if the first argument to these methods contains user-controlled input

• Verifies the input is not properly sanitized/escaped

• Reports a vulnerability if unsafe user data flows into raw SQL query methods

Vulnerable code example

<?php

public function show(Request $request) {
    $userId = $request->input('id');  // User input could be malicious like "1 OR 1=1"
    
    // VULNERABLE: Direct concatenation of user input in raw SQL query
    $user = User::whereRaw("id = " . $userId)->first();
    ...

✅ Secure code example

<?php

public function show(Request $request) {
    $userId = $request->input('id');
    
    // SECURE: Using parameterized query with placeholder and bound value
    $user = User::whereRaw("id = ?", [$userId])->first();
    ...