SQL Injection Scan

What this check runs

This check probes your application's inputs for SQL injection, in the style of sqlmap. It sends crafted values into parameters, forms and query strings and watches for the responses that reveal a query can be manipulated, then characterises how deep the exposure goes.

Why it matters

SQL injection remains one of the most damaging web vulnerabilities because it targets the database directly. A single injectable parameter can let an attacker read every row in your database, bypass authentication, modify or delete data, and on some configurations execute commands on the database host.

Laravel's Eloquent and query builder protect you when used as intended, because they parameterise queries. The exposure appears where developers step outside that path: raw queries built with string concatenation, whereRaw with interpolated input, or dynamic column and table names taken from user input. The framework's protection is real but it is not automatic for code that bypasses it.

What the findings mean

A finding here means the scan identified an input where the underlying query could be influenced. This is a high-severity result whenever it appears, because the floor for SQL injection impact is full read access to the database.

The fix is ensuring every query uses parameter binding, never string interpolation, and validating any input that controls query structure such as column or sort parameters, covered in the SQL injection guide.

See the step-by-step remediation: how to fix this.