title: Laravel - Code Review
body: <p>I am doing a code review in a php Laravel project. I am still relatively new to the framework. I have been using it for about 1.5+ years. I do not know all the inner workings and need some advice. I like to think i have very good handle on php though. My question is with the code below. In PHP, i would use PDO and bound parameters for everything, this code seems to be missing it. Are there any security concerns? This is in Laravel 4.2.</p>
  
  <pre><code>try {
      $stmt = DB::select('SELECT a.email, a.zipcode, a.is_subscribed, b.no_longer_available, b.reduced_price,b.newly_listed
                            FROM users a INNER JOIN user_preferences b ON (a.user_id = b.user_id)
                            WHERE a.user_id = "' . $this-&gt;user-&gt;user_id . '";');
  } catch (Exception $e) {
      return FALSE;
  }
  </code></pre>
  
  <p>You can see the string is in the function and not bound. In laravel, shouldn't something like DB::select($sql, $params) be used?</p>
  
  <p>Second question: Is the code below even valid Laravel code? I cannot find any documentation on it.</p>
  
  <pre><code>$sql = "UPDATE users a INNER JOIN user_preferences b ON a.user_id = b.user_id
              SET a.is_subscribed = '$is_subscribed',b.no_longer_available = '$no_longer_available',
                  b.reduced_price = '$reduced_price', b.newly_listed = '$newly_listed'
              WHERE a.user_id = '$user_id';";
  
  try 
  {
      $stmt = DB::update($sql);
      $count = count($stmt);
  } catch (Exception $e) {
      return FALSE;
  }
  </code></pre>
  
  <p>Assume all those $variables are valid.</p>
  
  <pre><code>is: $stmt = DB::update($sql); even a valid Laravel function/method
  </code></pre>