SQL injection is not possible, as Laravel uses prepared statements/parameter binding.

I was curious about this as well... looks like an issue when using raw queries. Found a great article and wanted to pass it along for anyone else that may need it.

http://fideloper.com/laravel-raw-queries

Laravel does use prepared statements as barry mentioned, but it looks like you need to specifically pass variables in an array of bindings for this to happen with raw queries.

$someVariable = Input::get("some_variable");

$results = DB::select( DB::raw("SELECT * FROM some_table WHERE some_col = :somevariable"), array(
   'somevariable' => $someVariable,
 ));