in reply to security question, mysql, limit, dbi, and placeholders

Use of placeholder does prevent exactly what you are afraid of. What you might want to do is to turn on the ShowErrorStatement attribute in the handle - this will print the complete statement send to the database.

Abigail