在laravel上保护SQL注入

Question

I need to do auto completion on site, I use laravel. now it work like this:

Group:: whereRaw( where lower (name) like lower ('$q%'))->get ()

But it is not safe I try do like this:

$q="a"; group:: whereRaw("lower (name) like lower ('?%')",[$q])->get ()

always return empty array, but

$q="a"; group:: whereRaw("lower (name) like lower ('$q%')")->get () 

return correct result

Answer 1

As mentioned, LIKE is case insensitive, so you don't need lower or raw.

Group::where('name', 'LIKE', $q."%")->get();