you have an sql injection here, use `$db->sql_escape()`