{"id":"cfd0a9e8426e2006","repo":"laravel/framework","slug":"the-database-connection-does-not-support-escaping","errorCode":null,"errorMessage":"The database connection does not support escaping arrays.","messagePattern":"The database connection does not support escaping arrays\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Illuminate/Database/Connection.php","lineNumber":1179,"sourceCode":"     *\n     * @param  string|float|int|bool|null  $value\n     * @param  bool  $binary\n     * @return string\n     *\n     * @throws \\RuntimeException\n     */\n    public function escape($value, $binary = false)\n    {\n        if ($value === null) {\n            return 'null';\n        } elseif ($binary) {\n            return $this->escapeBinary($value);\n        } elseif (is_int($value) || is_float($value)) {\n            return (string) $value;\n        } elseif (is_bool($value)) {\n            return $this->escapeBool($value);\n        } elseif (is_array($value)) {\n            throw new RuntimeException('The database connection does not support escaping arrays.');\n        } else {\n            if (str_contains($value, \"\\00\")) {\n                throw new RuntimeException('Strings with null bytes cannot be escaped. Use the binary escape option.');\n            }\n\n            if (preg_match('//u', $value) === false) {\n                throw new RuntimeException('Strings with invalid UTF-8 byte sequences cannot be escaped.');\n            }\n\n            return $this->escapeString($value);\n        }\n    }\n\n    /**\n     * Escape a string value for safe SQL embedding.\n     *\n     * @param  string  $value\n     * @return string","sourceCodeStart":1161,"sourceCodeEnd":1197,"githubUrl":"https://github.com/laravel/framework/blob/bd6b5437e6ad87bb49f9b426724f07a9f64e9683/src/Illuminate/Database/Connection.php#L1161-L1197","documentation":"Thrown by Connection::escape() when the value passed is a PHP array. The generic escape() only handles scalar/null/bool and explicitly rejects arrays because SQL cannot embed a multi-value literal safely. Array values should be turned into an IN (...) via parameter binding or escaped element-by-element.","triggerScenarios":"Calling $connection->escape($array) directly, or routing user input that is sometimes an array into a raw where clause; using escape() inside a custom builder/macro that receives a variadic list; DB::raw() + escape on request input that is an array (e.g. ?ids[]=1).","commonSituations":"Building WHERE IN clauses by hand with escape(); passing $_GET array params into a raw expression; a cast or accessor that returns an array reaching escape().","solutions":["Use parameter bindings / whereIn() instead of manually escaping arrays.","Flatten and escape each element: implode(',', array_map(fn ($v) => $connection->escape($v), $array)).","Validate that the input is scalar before calling escape(), and reject or normalize arrays upstream.","Switch to a query builder method that accepts arrays natively (whereIn, whereJsonContains)."],"exampleFix":"// before\n$sql = '... where id in ('.DB::connection()->escape($request->input('ids')).')';\n\n// after\n$rows = DB::table('users')->whereIn('id', $request->input('ids', []))->get();","handlingStrategy":"validation","validationCode":"$value = $request->input('ids');\nif (is_array($value)) {\n    // use whereIn, or escape each element separately\n    $rows = DB::table('t')->whereIn('id', $value)->get();\n    return;\n}\n$sql = '... where id = '.$connection->escape($value);","typeGuard":"function isEscapeableScalar(mixed $v): bool {\n    return $v === null || is_scalar($v) || $v instanceof \\Stringable;\n}","tryCatchPattern":null,"preventionTips":["Never feed array user input into escape(); route it through whereIn() or implode mapped escapes.","Coerce request input to a single scalar before escaping when only one value is expected.","Add a test that asserts escape() receives only scalars from your builder code.","Prefer prepared statements / query builder over hand-escaped SQL."],"tags":["escaping","sql-injection","validation"],"analyzedSha":"bd6b5437e6ad87bb49f9b426724f07a9f64e9683","analyzedAt":"2026-08-06T00:28:32.783Z","schemaVersion":2}