Language: PHP
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public function getPairs($data)
    {
        $limit = $data['per_page'] ?? 30;
        [$sql, $params] = $this->getSearchQuery($data, "SELECT c.id, CONCAT_WS('', c.first_name,  ' ', c.last_name) as full_name");
        $sql = $sql . ' LIMIT ' . $limit;

        return $this->di['db']->getAssoc($sql, $params);
    }