Protect insert from sql injection

Author: Dylan-DutchAndBold

src/Eloquent/BaseBuilder.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Grimzy\LaravelMysqlSpatial\Eloquent;
+
+use \Illuminate\Database\Query\Builder;
+
+class BaseBuilder extends Builder
+{
+    /**
+     * Remove all of the expressions from a list of bindings.
+     *
+     * @param  array  $bindings
+     * @return array
+     */
+    protected function cleanBindings(array $bindings)
+    {
+        $bindings = array_map(function ($binding) {
+            return $binding instanceof SpatialExpression ? $binding->getSpatialValue() : $binding;
+        }, $bindings);
+
+        return parent::cleanBindings($bindings);
+    }
+}

src/Eloquent/Builder.php

@@ -20,6 +20,6 @@ public function update(array $values)
 
     protected function asWKT(GeometryInterface $geometry)
     {
-        return $this->getQuery()->raw("ST_GeomFromText('".$geometry->toWKT()."')");
+        return new SpatialExpression($geometry);
     }
 }

src/Eloquent/SpatialExpression.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Grimzy\LaravelMysqlSpatial\Eloquent;
+
+use Illuminate\Database\Query\Expression;
+
+class SpatialExpression extends Expression
+{
+    public function getValue()
+    {
+        return 'ST_GeomFromText(?)';
+    }
+
+    public function getSpatialValue()
+    {
+        return $this->value->toWkt();
+    }
+}

src/Eloquent/SpatialTrait.php

@@ -61,12 +61,21 @@ public function newEloquentBuilder($query)
         return new Builder($query);
     }
 
+    protected function newBaseQueryBuilder()
+    {
+        $connection = $this->getConnection();
+
+        return new BaseBuilder(
+            $connection, $connection->getQueryGrammar(), $connection->getPostProcessor()
+        );
+    }
+
     protected function performInsert(EloquentBuilder $query, array $options = [])
     {
         foreach ($this->attributes as $key => $value) {
             if ($value instanceof GeometryInterface) {
                 $this->geometries[$key] = $value; //Preserve the geometry objects prior to the insert
-                $this->attributes[$key] = $this->getConnection()->raw(sprintf("ST_GeomFromText('%s')", $value->toWKT()));
+                $this->attributes[$key] = new SpatialExpression($value);
             }
         }