Difference between DB::Table and DB::Select

Question

At the moment I am using:

DB::select('select * from users ');

but now I'm reading on http://laravel.com/docs/4.2/queries

about:

$users = DB::table('users')->get();

Both give back the same. Is there something different between these two?

In the documentation it does say: Note: The Laravel query builder uses PDO parameter binding throughout to protect your application against SQL injection attacks. There is no need to clean strings being passed as bindings.

For the second method. Does this mean the first method doesn't protect you against SQL injection? Is the second method a better way? Both return the results in a different way as well right?

Can I get some explanation about this?

Answer 1

No, the only difference here is the syntax. Yes, a DB::select doesn't protect against SQL injection. But SQL injection is only a risk when you pass in user input. For example this is vulnerable to SQL injection:

DB::select('SELECT * FROM users WHERE name = "'.Input::get('name').'"');

Whereas this is not:

DB::table('users')->where('name', Input::get('name'))->get();

But also this isn't: (Using bindings "manually")

DB::select('SELECT * FROM users WHERE name = ?', array(Input::get('name')));

---

The great advantage of the query builder (besides automatically protecting against SQL injection) is it's flexible syntax. For example you could use a loop to add where statements:

$query = DB::table('users');

foreach($names as $name){
    $query->orWhere('name', 'LIKE', $name.'%');
}

$result = $query->get();