title: DB::statement(); in Laravel (5.5)
body: <p>I'm building an application with Laravel 5.5 and I have to run some SQL queries for extended PostgreSQL which are not supported by Eloquent ORM (PostGIS). Instead, I use DB::statement($queryString); to insert data into database. $queryString is built from input variables concatenated with pre-built SQL statement.</p>
  
  <p>Here is the code from my controler (note that actual query is more complex, this is just an example):</p>
  
  <pre><code>/**
   * Store a newly created resource in storage.
   *
   * @param  \Illuminate\Http\Request  $request
   * @return \Illuminate\Http\Response
   */
  public function store(Request $request)
  {   
      $id= $request-&gt;input('id');
      $name= $request-&gt;input('name');
      $geom = $request-&gt;input('geom');
  
      $geom = DB::raw("ST_TRANSFORM(ST_GeomFromGeoJSON('".$geom."'), 3857)");
  
  
      $statement = "INSERT INTO tableName(id, name) VALUES ('".$id."', '".$name."', ".$geom.");";
      DB::statement($statement);
      return 'Insert Successful';
  }
  </code></pre>
  
  <p>I have two question about this approach:</p>
  
  <ol>
  <li><p>How can I protect my application from SQL injection attacks?</p></li>
  <li><p>How can I check if query ran successfully? DB::statement doesn't seem to return anything.</p></li>
  </ol>