Thanks for the quick response. The discussion you pointed to was indeed very informative.

What I ended up doing was dynamically creating my set_sql string, thus when I call my search_withlimit call I don't need to pass it any parameters, so they can't get filled in incorrectly.