Mask Query Bindings in Laravel Exception Messages | Mohamed Said [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://www.msaied.com) [ Home ](https://www.msaied.com) [ Projects ](https://www.msaied.com/projects) [ Articles ](https://www.msaied.com/articles) [ Certificates ](https://www.msaied.com/certificates) [ Contact ](https://www.msaied.com#contact-section) [ ](https://github.com/EG-Mohamed) [ Home ](https://www.msaied.com) [ Projects ](https://www.msaied.com/projects) [ Articles ](https://www.msaied.com/articles) [ Certificates ](https://www.msaied.com/certificates) [ Contact ](https://www.msaied.com#contact-section) [ home ](https://www.msaied.com) [ articles ](https://www.msaied.com/articles) Mask Query Bindings in Laravel Exception Messages On this page 1. [ The Problem: Bound Values End Up Everywhere ](#the-problem-bound-values-end-up-everywhere) 2. [ The Fix: mask\_bindings\_in\_exception\_messages ](#the-fix-codemask-bindings-in-exception-messagescode) 3. [ Enabling It in config/database.php ](#enabling-it-in-codeconfigdatabasephpcode) 4. [ What the Message Looks Like After Masking ](#what-the-message-looks-like-after-masking) 5. [ Key Takeaways ](#key-takeaways) ![Mask Query Bindings in Laravel Exception Messages](https://cdn.msaied.com/603/3011313796d00cd5c4e1ead00e1e9ba1.png) [ Laravel ](https://www.msaied.com/articles?category=laravel) [ Tips & Tricks ](https://www.msaied.com/articles?category=tips-tricks) #Laravel #Security #QueryException #PII #Database Mask Query Bindings in Laravel Exception Messages =================================================== 27 Aug 2026 3 min read ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said Table of contents 1. [ 01 The Problem: Bound Values End Up Everywhere ](#the-problem-bound-values-end-up-everywhere) 2. [ 02 The Fix: mask\_bindings\_in\_exception\_messages ](#the-fix-codemask-bindings-in-exception-messagescode) 3. [ 03 Enabling It in config/database.php ](#enabling-it-in-codeconfigdatabasephpcode) 4. [ 04 What the Message Looks Like After Masking ](#what-the-message-looks-like-after-masking) 5. [ 05 Key Takeaways ](#key-takeaways) The Problem: Bound Values End Up Everywhere ------------------------------------------- When a database query fails in Laravel, the framework throws a `QueryException` whose message contains the full SQL statement with every bound value interpolated inline. This is intentional — a message like `SQL: insert into "users" ("email") values (?)` tells you almost nothing about what went wrong, while the interpolated version pinpoints the offending row immediately. The trouble is that exception messages do not stay in one place. Consider this realistic `QueryException` message: ```typescript SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry 'ada@example.com' for key 'users_email_unique' (Connection: mysql, SQL: insert into `users` (`email`, `name`, `national_id`) values (ada@example.com, Ada Lovelace, 640312-4185)) ``` Every bound value — an email address, a full name, a government identifier — is now a plain string inside an exception. That string travels to: - **Application log files** written by your logging stack. - **The `failed_jobs` table**, because `DatabaseFailedJobProvider::log()` casts the exception to a string before inserting it. - **APM and OpenTelemetry agents**, which record the exception on the active span. - **Any third-party error-reporting service** your application sends exceptions to. Anywhere exceptions are persisted or transmitted, a copy of those bindings now lives. The Fix: `mask_bindings_in_exception_messages` ---------------------------------------------- Laravel 13.27 introduces a per-connection configuration key that stops the interpolation before the message is built. ### Enabling It in `config/database.php` ```php 'connections' => [ 'mysql' => [ 'driver' => 'mysql', // ... 'mask_bindings_in_exception_messages' => env('DB_MASK_BINDINGS', false), ], ], ``` The key is already present in the framework's own `config/database.php` for all five default connections. If your application has never published that file, you do not need to publish it — just set the environment variable: ```php DB_MASK_BINDINGS=true ``` ### What the Message Looks Like After Masking With the option enabled, bound values are replaced by their original `?` placeholders: ```sql SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry 'ada@example.com' for key 'users_email_unique' (Connection: mysql, SQL: insert into `users` (`email`, `name`, `national_id`) values (?, ?, ?)) ``` The database error itself (including the duplicate-entry value surfaced by MySQL) is still present, but none of the application-supplied bindings appear in the message. Key Takeaways ------------- - Laravel's `QueryException` interpolates bound values into its message by default, which can expose PII in logs, `failed_jobs`, and observability tooling. - Laravel 13.27 adds `mask_bindings_in_exception_messages` as a per-connection option in `config/database.php`. - Setting `DB_MASK_BINDINGS=true` is sufficient for applications that have not published the database config file. - Masking is opt-in and per-connection, so you can apply it selectively to connections that handle sensitive data. - The SQL structure and the database-level error message remain intact; only the application-supplied binding values are withheld. --- *Source: [Mask Query Bindings in Laravel Exception Messages — Laravel News](https://laravel-news.com/laravel-mask-query-bindings)* Found this useful? [ ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.msaied.com%2Farticles%2Fmask-query-bindings-in-laravel-exception-messages&text=Mask+Query+Bindings+in+Laravel+Exception+Messages) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.msaied.com%2Farticles%2Fmask-query-bindings-in-laravel-exception-messages) Frequently Asked Questions ---------------------------- 3 questions Q01 Does enabling mask\_bindings\_in\_exception\_messages affect all database connections automatically? No. The option is configured per connection inside the `connections` array in `config/database.php`. You can enable it on specific connections that handle sensitive data while leaving others unchanged. Q02 Will masking bindings make it harder to debug query failures? The SQL structure, table names, column names, and the database-level error message (including any values the database engine itself surfaces, such as a duplicate-entry value) are still present in the exception message. Only the application-supplied bound values are replaced with `?` placeholders. Q03 Do I need to publish config/database.php to use this feature? No. Laravel 13.27 ships the key in the framework's own `config/database.php` for all five default connections. Applications that have never published that file can simply set the `DB_MASK_BINDINGS=true` environment variable. Continue reading More Articles --------------- [ View all ](https://www.msaied.com/articles) [ ![Laravel Queues at Scale: Backpressure, Dead-Letter Queues, and Graceful Degradation](https://cdn.msaied.com/602/fcffaaa5442f84486d6059eaa4106d26.png) laravel queues reliability ### Laravel Queues at Scale: Backpressure, Dead-Letter Queues, and Graceful Degradation Beyond basic queue workers: learn how to implement backpressure signals, dead-letter queues, and graceful degr... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 28 Aug 2026 3 min read Read ](https://www.msaied.com/articles/laravel-queues-at-scale-backpressure-dead-letter-queues-and-graceful-degradation) [ ![whereBinary(): How to Run Case-Sensitive MySQL Queries in Laravel 13.27](https://cdn.msaied.com/600/0c7655400b43d3b85d1d1e9d0f4c8094.png) Laravel MySQL Query Builder ### whereBinary(): How to Run Case-Sensitive MySQL Queries in Laravel 13.27 Laravel 13.27 adds whereBinary(), orWhereBinary(), whereNotBinary(), and orWhereNotBinary() — clean query-buil... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 26 Aug 2026 4 min read Read ](https://www.msaied.com/articles/wherebinary-how-to-run-case-sensitive-mysql-queries-in-laravel-1327) [ ![Compile PHP to Native Binaries with TypePHP](https://cdn.msaied.com/599/a0eb0516fcca2a7c2e83f4aabf206988.png) TypePHP AOT Compiler PHP Performance ### Compile PHP to Native Binaries with TypePHP The Swoole team has open-sourced TypePHP, an Ahead-Of-Time (AOT) compiler that translates PHP source code into... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 26 Aug 2026 3 min read Read ](https://www.msaied.com/articles/compile-php-to-native-binaries-with-typephp) [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://www.msaied.com)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. Explore - [Home](https://www.msaied.com) - [Projects](https://www.msaied.com/projects) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [Contact](https://www.msaied.com#contact-section) Connect - [ hello@msaied.com ](mailto:hello@msaied.com) - [ +20 109 461 9204 ](tel:+201094619204) © 2026 Mohamed Said. All rights reserved. [ ](https://github.com/EG-Mohamed) [ ](https://www.linkedin.com/in/msaiedm/) [ ](https://wa.me/201094619204) [ ](mailto:hello@msaied.com) [ ](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view)