Validating a search string for an SQL text search Is it safe to allow these special characters when validating a string? The user is currently allowed to send alpha numeric and the following special characters from the browser:

',.!&amp;()_-


My main concern is code injection. I'm still learning Laravel and I understand it handles a lot security wise. I'd like to make sure I'm taking solid precautions for good security.

I have the following code which uses the PHP Laravel framework to validate on the server side:

$this-&gt;validate($request, [
    'str' =&gt; 'bail|required|regex:/^[a-zA-Z0-9 \',.!&amp;_-]+$/u'
]);

$search_str = $request-&gt;str;

$query = Story::where('story_text', 'LIKE', '%'.$search_str.'%');


Is this sufficiently secure or is there more I should be doing?
Laravel's Eloquent uses PDO's parameterized queries, so you get the same level of protection from SQL injection attacks as using PDO directly. Which is to say, you don't generally need to worry about sanitizing your input with Laravel.

The main exception being if you ever use Eloquent's raw query. You should avoid passing user-supplied input to a raw query at pretty much any price, but that's where you'd need to sanitize.

As for the input validation, you should just be using it to make sure the inputs conform to your requirements. For instance, ensuring that something looks like an email or is alphanumeric. Or to make sure inputs correspond to an extant record in the database. It's almost never necessary to use it for input sanitization and will probably end up confusing both you and the user, later on.