title: How to use DB::insert as a prepared statement LARAVEL
body: <p>I am trying to make my insert query protected against sql injection. But I am having issues getting this to work. any ideas?
  I have tried several things.</p>
  
  <pre><code> $bullets = Input::get('bullet_content');
          $product_id = Input::get('product_id');
          $user_id = Input::get('user_id');
          $retailer_id = Input::get('retailer_id');
          $date = date("Y-m-d H:i:s");
          foreach ($bullets as $bullet){
  
  
              $query = "'INSERT INTO bullets(product_id, user_id,bullet_content, bullet_deleted, created_at, updated_at) 
                          VALUES('?','?','?','?','?','?')', [$product_id,$user_id,$bullet,'N',$date,$date]";
  
  
                          DB::insert($query);
          }
          return back()-&gt;with('message','Features add successfully!');
  </code></pre>
  
  <p>When I try this I get the following errror:</p>
  
  <pre><code>SQLSTATE[07002]: [Microsoft][ODBC Driver 11 for SQL Server]COUNT field incorrect or syntax error (SQL: 'INSERT INTO bullets(product_id, user_id,bullet_content, bullet_deleted, created_at, updated_at) VALUES('?','?','?','?','?','?')', [1,1,can't,'N',2017-11-10 16:28:44,2017-11-10 16:28:44])
  </code></pre>
  
  <p>I have also tried:</p>
  
  <pre><code> $bullets = Input::get('bullet_content');
          $product_id = Input::get('product_id');
          $user_id = Input::get('user_id');
          $retailer_id = Input::get('retailer_id');
          $date = date("Y-m-d H:i:s");
          foreach ($bullets as $bullet){
  
  
              $query = "'INSERT INTO bullets(product_id, user_id,bullet_content, bullet_deleted, created_at, updated_at) 
                          VALUES('?','?','?','?','?','?')' ";
              $values = [$product_id,$user_id,$bullet,'N',$date,$date];
  
                          DB::insert($query,$values);
          }
          return back()-&gt;with('message','Features add successfully!');
  </code></pre>
  
  <p>and got the following error:</p>
  
  <pre><code>SQLSTATE[42000]: [Microsoft][ODBC Driver 11 for SQL Server][SQL Server]Incorrect syntax near 'INSERT INTO bullets(product_id, user_id,bullet_content, bullet_deleted, created_at, updated_at) VALUES('. (SQL: 'INSERT INTO bullets(product_id, user_id,bullet_content, bullet_deleted, created_at, updated_at) VALUES('1','1','can't','N','2017-11-10 16:33:43','2017-11-10 16:33:43')' )
  </code></pre>