title: Laravel/PDO not escaping backslashes or quotes?
body: <p>In laravel, I have a search box a user can type into for searching the database.</p>
  
  <p>It executes the following code when submitted (just showing the important parts here).</p>
  
  <pre><code>$searchBox = $request-&gt;get('searchBox');
  
  ...
  $getSearch-&gt;where(function($query) use($searchBox) {
      $query-&gt;orWhere('event', 'LIKE', '%'.$searchBox.'%');
      $query-&gt;orWhere('sub_event', 'LIKE', '%'.$searchBox.'%');
  });
  </code></pre>
  
  <p>The problem is if the use inputs a double quote (") or a backslash () the query fails. It appears to no be escaping those characters.</p>
  
  <p>If I do this.</p>
  
  <pre><code>$searchBox = addslashes($searchBox);
  </code></pre>
  
  <p>Then it works great. </p>
  
  <p>I don't know if this is a laravel or a PDO issue (or not an issue at all).  Do I need to be sanitizing all user input for backslashes? Should I be using addslashes? Or am I not understanding how this is supposed to work.</p>
  
  <p>How do I perform a LIKE search in mysql/PDO/laravel when the search terms contain backslashes or double quotes?</p>
  
  <p>Thanks</p>
  
  <p>*edit</p>
  
  <p>I should have checked what the error I was getting actually was. I have now done that.</p>
  
  <p>I thought it was giving a weird error, because it was giving my webpage redirect loops when I ran the query. But the comment by @David Smith below made me recheck that. Turns out, it was a zero result from the query that was causing the loops. </p>
  
  <p>So sorry, I should have been more clear on that from the beginning. The query doesn't actually 'fail', I just get no results.</p>
  
  <p>But I need people to be able to search comments/fields that may (and do) have backslashes and double quotes in them.</p>
  
  <p>Actually, fixing the loops seems that double quotes now works. Its just backslashes that cause zero results. If I search a phrase that has a backslash, I get no results.</p>
  
  <p>I'm not thinking that is because the query treats the backslash as an escape character, instead of a backslash to search for.</p>
  
  <p>If that's right, then how do I allow my users to search for terms containing a backslash?  Is addslashes still the way to go?</p>