Raw expressions in Laravel - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a raw expression in Laravel's query builder?

A raw expression lets you write plain SQL inside Laravel's query builder. It tells Laravel not to escape or modify the SQL part you write.

beginner

How do you create a raw expression in Laravel?

Use the DB::raw() method. For example: DB::raw('COUNT(*)') creates a raw SQL expression for counting rows.

intermediate

Why should you be careful when using raw expressions?

Raw expressions bypass Laravel's protection against SQL injection. You must ensure the raw SQL is safe and does not include user input directly.

beginner

Example: How to select users with a raw SQL condition for age > 30?

Use: User::whereRaw('age > 30')->get(); This runs the raw SQL condition inside the query.

intermediate

Can you use raw expressions in select statements?

Yes! For example: User::select(DB::raw('COUNT(*) as user_count'))->get(); This counts users using raw SQL inside select.

What does DB::raw() do in Laravel?

A Automatically escapes SQL inputs

B Validates user input

C Creates a new database connection

D Allows writing plain SQL inside query builder

DB::raw() lets you write raw SQL expressions that Laravel will not modify or escape.

Which method uses raw SQL conditions in Laravel queries?

A whereRaw()

B whereSafe()

C whereClean()

D whereSecure()

whereRaw() allows you to add raw SQL conditions to your query.

Why is it risky to use raw expressions with user input?

A It slows down the query

B It can cause SQL injection if not handled properly

C It automatically deletes data

D It disables database connections

Raw expressions bypass Laravel's protections, so unsafe user input can lead to SQL injection.

How do you count rows using raw expressions in Laravel?

A select(DB::raw('COUNT(*) as count'))

B countRaw()

C count()

D rawCount()

You use select(DB::raw('COUNT(*) as count')) to count rows with raw SQL.

Which of these is NOT a use of raw expressions?

A Writing custom SQL functions

B Bypassing query builder protections

C Automatically escaping user input

D Adding complex SQL conditions

Raw expressions do NOT automatically escape user input; they bypass protections.

Explain what raw expressions are in Laravel and when you might use them.

Think about how Laravel lets you write plain SQL inside its query builder.

Describe how to safely use raw expressions in Laravel queries.

Focus on security best practices when mixing raw SQL with user data.

Practice

1. What is the primary purpose of using DB::raw() in Laravel queries?

easy

A. To insert raw SQL expressions directly into the query builder

B. To automatically escape all user inputs

C. To convert Eloquent models into arrays

D. To cache query results for faster access

Solution

1. Step 1: Understand the role of DB::raw()

   DB::raw() allows you to write raw SQL expressions inside Laravel's query builder without modification.

2. Step 2: Compare with other options

   Options B, C, and D describe different Laravel features unrelated to raw SQL expressions.

3. Final Answer:

   To insert raw SQL expressions directly into the query builder -> Option A

4. Quick Check:

   DB::raw() = raw SQL insertion [OK]

Hint: DB::raw() means write SQL exactly as is inside queries [OK]

Common Mistakes:

• Thinking DB::raw() escapes inputs automatically
• Confusing DB::raw() with model conversion
• Assuming DB::raw() caches queries

2. Which of the following is the correct syntax to use DB::raw() in a Laravel query builder to select the current date?

easy

A. DB::table('users')->select(DB::raw('CURRENT_DATE'))->get();

B. DB::table('users')->select('CURRENT_DATE')->get();

C. DB::table('users')->selectRaw('CURRENT_DATE')->get();

D. DB::table('users')->selectRaw(DB::raw('CURRENT_DATE'))->get();

Solution

1. Step 1: Identify correct raw expression usage

   DB::raw() wraps the raw SQL string inside select() to insert it as is.

2. Step 2: Analyze other options

   DB::table('users')->select('CURRENT_DATE')->get(); treats 'CURRENT_DATE' as a column name, not raw SQL. DB::table('users')->selectRaw('CURRENT_DATE')->get(); uses selectRaw() correctly but without DB::raw(), which is valid but not the exact syntax asked. DB::table('users')->selectRaw(DB::raw('CURRENT_DATE'))->get(); nests DB::raw() inside selectRaw(), which is incorrect.

3. Final Answer:

   DB::table('users')->select(DB::raw('CURRENT_DATE'))->get(); -> Option A

4. Quick Check:

   Use DB::raw() inside select() for raw SQL [OK]

Hint: Use DB::raw('SQL') inside select() for raw SQL [OK]

Common Mistakes:

• Using select() with string instead of DB::raw()
• Confusing selectRaw() and DB::raw() usage
• Nesting DB::raw() inside selectRaw() incorrectly

3. What will be the output of the following Laravel query?

DB::table('orders')
  ->select('id', DB::raw('price * quantity AS total'))
  ->where('status', 'completed')
  ->get();

medium

A. An empty collection because raw expressions are not supported in where clauses

B. A syntax error because raw expressions cannot have aliases

C. A collection of orders with id and a calculated total price (price * quantity)

D. A collection with only id and price fields, ignoring quantity

Solution

1. Step 1: Understand the select with DB::raw()

   The query selects 'id' and a raw SQL expression calculating 'price * quantity' as 'total'. This is valid and returns those fields.

2. Step 2: Check the where clause and output

   The where clause filters orders with status 'completed'. The output is a collection of matching orders with 'id' and 'total' fields.

3. Final Answer:

   A collection of orders with id and a calculated total price (price * quantity) -> Option C

4. Quick Check:

   DB::raw() with alias returns calculated fields [OK]

Hint: DB::raw() can calculate fields with aliases in select [OK]

Common Mistakes:

• Thinking raw expressions cannot have aliases
• Assuming raw expressions affect where clause support
• Ignoring the calculated field in output

4. Identify the error in this Laravel query using raw expressions:

DB::table('users')
  ->where(DB::raw('LENGTH(name)'), '>', 5)
  ->get();

medium

A. Raw expressions cannot be used inside where clauses

B. The syntax is correct; no error present

C. DB::raw() should be wrapped inside a closure for where

D. The comparison operator '>' is invalid in this context

Solution

1. Step 1: Review usage of DB::raw() in where clause

   Using DB::raw() inside where to apply SQL functions like LENGTH() is valid syntax in Laravel.

2. Step 2: Check operators and syntax

   The '>' operator is valid for comparison. No wrapping closure is required here.

3. Final Answer:

   The syntax is correct; no error present -> Option B

4. Quick Check:

   DB::raw() works in where clauses with operators [OK]

Hint: DB::raw() can be used directly in where with operators [OK]

Common Mistakes:

• Assuming raw expressions are disallowed in where
• Thinking a closure is needed for DB::raw() in where
• Misunderstanding comparison operator validity

5. You want to update all users' scores by adding 10 points using a raw SQL expression in Laravel. Which code snippet correctly achieves this safely?

hard

A. DB::table('users')->update(DB::raw('score = score + 10'));

B. DB::table('users')->update(['score' => 'score + 10']);

C. DB::table('users')->updateRaw('score = score + 10');

D. DB::table('users')->update(['score' => DB::raw('score + 10')]);

Solution

1. Step 1: Understand how to update with raw expressions

   To update a column by adding a value, use DB::raw() inside the update array to write the SQL expression.

2. Step 2: Analyze each option

   DB::table('users')->update(['score' => DB::raw('score + 10')]); correctly uses DB::raw('score + 10') as the new value. DB::table('users')->update(['score' => 'score + 10']); treats it as a string, not SQL. DB::table('users')->update(DB::raw('score = score + 10')); passes DB::raw() directly to update(), which expects an array, causing error. DB::table('users')->updateRaw('score = score + 10'); uses a non-existent updateRaw() method.

3. Final Answer:

   DB::table('users')->update(['score' => DB::raw('score + 10')]); -> Option D

4. Quick Check:

   Use DB::raw() inside update array for calculations [OK]

Hint: Use DB::raw() inside update array for arithmetic updates [OK]

Common Mistakes:

• Passing raw SQL as string without DB::raw()
• Calling non-existent updateRaw() method
• Passing DB::raw() directly instead of in array