	public function	queryLimit($cols, $table, $where="1=1", $order="", $offset=0, $max=100)
	{		
		$this->lastError = '';
		$this->lastResult = '';	
		$fetch = PDO::FETCH_ASSOC;

		try
		{
			$sql = ' SELECT SQL_CALC_FOUND_ROWS '.$cols.'
					   FROM '.$table.'
					  WHERE '.$where.'
 				   ORDER BY '.$order.' 
					  LIMIT '.$max.'
					 OFFSET '.$offset;

			$statement = $this->db->query($sql);
            $this->queries_count++;
			$statement->setFetchMode($fetch);
			$this->lastResult = $statement->fetchAll();
			$statement->closeCursor();
			unset($statement);
		}
		catch(PDOException $e)
		{
			$this->lastError = $e->getMessage();
		}
		catch(Exception $e)
		{
			return false;
		}		
		
		return empty($this->lastError);			
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.