The error occurs because you aren't taint checking your input. Taint checking can be a bit of a hassle, as is hunting down warnings but it is a necessary step in order to make your code secure.

So basically what you need to do is validate the tainted variable by using something like this:


That should fix the problem.

It's not to do with your SQL code as Andy pointed out