Laravel3: Do I need sanitization if I use Eloquent?

Question

This approach;

Route::get('admin/user/delete/(:any)', array('as' => 'username', 'uses' => 'admin@user_delete_process'));

public function action_user_delete_process($username)
{
    $result = User::find($username)->delete();
}

Do I need to worry about injections?

Answer 1

Generally speaking, ORM's handle all of the escaping. Unless you're passing in raw SQL queries, you should be fine without escaping your inputs. To confirm, I dug through Laravel's code, and came across the execute() method, which indeed utilizes PDO::prepare:

/** laravel/database/connection.php, lines 219-278 */
protected function execute($sql, $bindings = array())
{
    /* ... */
    try
    {
        $statement = $this->pdo->prepare($sql);

        $start = microtime(true);

        $result = $statement->execute($bindings);
    }
    // If an exception occurs, we'll pass it into our custom exception
    // and set the message to include the SQL and query bindings so
    // debugging is much easier on the developer.
    catch (\Exception $exception)
    {
        $exception = new Exception($sql, $bindings, $exception);

        throw $exception;
    }
    /* ... */
}