Changed pdo::query to pdo::prepare to enable value-binding

Author: rkrx

src/Builder/RunnableSelect.php

@@ -166,7 +166,7 @@ public function getFoundRows() {
 	private function createStatement() {
 		$db = $this->db();
 		$query = $this->__toString();
-		$statement = $db->query($query);
+		$statement = $db->prepare($query);
 		$statement->execute($this->values);
 		if($this->getCalcFoundRows()) {
 			$this->foundRows = $db->query('SELECT FOUND_ROWS()')->fetchColumn();