[Shadab]

PHP Code:

if( isset($_GET['ltr']) )
{
    $letter = $_GET['ltr'];
}

// <snip>

$itemcount = $db->query_first("
    SELECT COUNT(`uid`) AS `itemcount`
    FROM `" . TABLE_PREFIX . "mytable`
    WHERE colname LIKE '" . $letter . "%'"); 


$letter is assigned the value from $_GET['ltr']
and then directly used in the DB query without sanitizing it.

Is that safe ?