you have an sql injection here, use `$db->sql_escape()` or cast it into int maybe?