title: Does Laravel naturally prevent SQL injection when using raw SQL?
body: <p>I know everyone is using <code>DB::raw()</code> to execute a raw sql.</p>
  
  <p>I myself use the following instead:</p>
  
  <pre><code>DB::select("query string?", [$var]);
  DB::insert("query string?", [$var]);
  DB::update("query string?", [$var]);
  DB::delete("query string?", [$var]);
  </code></pre>
  
  <p>does Laravel already provide defense against SQL injection or I still need to escape my variables?</p>