Since ```$variable``` is coming directly from a query string, you should wrap it in ```$this->mDb->addQuotes( $variable )``` (a general good practice) and/or ensure it is an integer here to make sure nothing dodgy can get into the query. You can also change the ```getVal``` above to [```getInt```](https://github.com/Wikia/app/blob/dev/includes/WebRequest.php#L427) as a way to ensure it is an int.