$sql = \"SELECT * FROM table WHERE id LIKE CONCAT(\'%\', :id, \'%\') LIMIT :limit1, :limit2\";
I want to still use the array input like this:
Why bind limit values when they're not user input?
$start = 0; $limit = 20; $sql = "SELECT * FROM table WHERE id LIKE CONCAT('%', :id, '%') LIMIT $start, $limit";
Even if $start and $limit are determined from user input, say from a $_GET, you can test the value with is_int().
$start
$limit
$_GET
is_int()