Can you make sure to `$db->escapeNumber` all of these variables, it shouldn't be needed but if anyone ever changes the checks above then it could add a vulnerability by accident - basically I'm just a bit paranoid when it comes to directly embedding variables in SQL queries, I've had to remove a fair few SQL injection vulnerabilities from SMR over the years.