Are there vulnerabilities if I don't process the string?

Question

Laravel

I have an alias url parameter, before there was an id , I processed it stupidly leading to a number , but what about the string , I know that there are prepared queries through the query builder and you shouldn’t worry about sql injections. Do I still need to take or process a parameter somehow?

Answer 1

With prepared parameters, it's not worth it. Just don't use a parameter in a Raw Expression that won't be processed further. Those. this is not how you should do it

$users = DB::table('users')
                     ->select( DB::raw($_GET['select_only_columns']) )
                     ->where('status', '<>', 1)
                     ->groupBy('status')
                     ->get();