Use Eloquent or the Query Builder for normal database access. Their standard query methods use PDO parameter binding for values, so user input is sent separately from the SQL structure instead of being concatenated into a query string.

Treat raw SQL carefully. When using selectRaw, whereRaw, or similar APIs, pass user values as bindings rather than interpolating them. PDO cannot bind SQL identifiers such as column names or sort directions, so any user-controlled identifiers must be selected from a strict allowlist. Never place untrusted values in an unprepared statement.