Will It Vibe?Raw query-builder fragment built from a variable
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
DB::raw(), whereRaw(), selectRaw(), orderByRaw(), and havingRaw() insert their argument into the query verbatim, with no escaping. Splicing a $variable into that fragment (rather than using a ? placeholder and passing the value as a binding) is SQL injection if the variable is ever influenced by request input.
Why it matters
DB::raw() and the *Raw() query builder helpers insert their argument into the query exactly as written, with none of Eloquent's normal parameter binding. Splicing a variable into that raw fragment reopens the SQL injection risk the query builder otherwise protects against, and it is easy to miss in review because the surrounding code looks like safe, fluent Eloquent.
How to fix it
Pass a ? placeholder in the raw fragment and give the actual value as the second argument, the bindings array, for example whereRaw('id = ?', [$id]) instead of whereRaw("id = $id"). Reserve DB::raw() for genuinely static SQL fragments like column expressions, never for anything containing a variable.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo