refactor: secure database queries against parameter tampering

[deepsource-dev-autofix]

Overview:
This PR refactors the database query logic to use MySQLi prepared statements for pagination parameters, replaces legacy db_* functions with native methods, and adds error logging for connection failures. By parameterizing inputs and casting them explicitly, we now defend against tampering attacks and ensure a secure fail‐open behavior.

• Parameter Tampering: The original code concatenated user‐controlled pagination values (start and limit) and dynamic ORDER BY clauses directly into the SQL string, exposing the application to tampering or injection. We now prepare the query with ? placeholders, cast start and limit to integers, and bind them before execution, ensuring only valid numeric inputs can be used. We also added connection error handling to log failures and safely default to no results if the database is unreachable.

No changes were made to external security configuration files. Assumption: the $order_by variable is validated elsewhere to prevent malicious column injection—please review that validation logic to confirm it cannot be manipulated by end users.

This Autofix was generated by AI. Please review the change before merging.