Laravel Eloquent 13

Last reviewed Sep 25, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. PHP 8.5145 lines · 5.4K tokens
  2. Laravel 1368 lines · 2.4K tokens
  3. Laravel Eloquent 1372 lines · 3.3K tokens
Total285 lines · 11.1K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 93
  • 95
  • 98
  • 117
  • 187
  • 201
  • 208
  • 209
  • 214
  • 252
  • 256
  • 295
  • 307
  • 312
  • 323
  • 338
  • 340
  • 352
  • 354
  • 367
  • 384
  • 390
  • 409
  • 434
  • 470
  • 502
  • 522
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 639
  • 674
  • 732
  • 770
  • 776
  • 798
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 940
  • 942
  • 1004
  • 1275
  • 1333
  • 1395

Prompt Preview

Apply the Laravel 13 prompt first; its release rule says which Laravel Framework release to run. These rules cover Eloquent 13 query composition, assignment, tenant isolation, relationships, bulk writes, casts, serialization, and transaction boundaries.

Query composition and bounded loading

  • Use bindings for values in selectRaw(), whereRaw(), havingRaw(), orderByRaw(), groupByRaw(), and fromQuery(); DB::raw() and DB::unprepared() do not bind their contents. Map client-selectable fields, relations, aggregates, operators, and ordering to fixed expressions rather than accepting SQL structure.
  • Group alternative predicates inside a where(function ($query) { ... }) closure. An ungrouped orWhere() after a relationship or tenant condition can broaden the query beyond that boundary; preserve grouping when using chunkById() or lazyById() too.
  • Constrain eager-loaded rows independently of parent selection. whereHas() filters parents but does not constrain a separate with(); use matching constraints or withWhereHas() when both operations must see the same authorized children, and constrain each morphTo target type.
  • Cap page sizes, filter-list lengths, relation depth, eager-loaded rows, and aggregate work; a parent limit() does not bound its relationships. Configure database execution limits and treat DB::whenQueryingForLongerThan() as monitoring, not query cancellation.
  • Process large reads with bounded lazy() batches, or chunkById() / lazyById() when changing filtered rows; keep the traversal key stable. Do not promise bounded