Creating a secure CRUD class with PDO - php

Question

I created a class to handle CRUD more easily and got a problem.
My current class runs a crud in this syntax:
$crud = Core::Db()->builder();
$userData =$crud
->select("city,adress")
->from('users')
->where('name')
->like(':name')
->read(array(':name','%stefan'));
When you call crud method, automatically creates and inserts sql sentence to private variable $this->sql. write() prepare data and binds prepared statements(if exists).
Last example generates the following SQL:
$this-sql = "SELECT city,address FROM users WHERE name LIKE :name";
Everything works perfect. Binds :name and adds'%stefan'. All ok.
this is my problem. if i add :
$userData =$crud
->select("city,adress")
->from('users')
->where('name')
->like('%stefan')
->read();
returns :
//bad syntax
$this->sql = "SELECT `city`,`address` FROM `users` WHERE `name` LIKE %stefan";
If I add quotes to data, the second example will work fine, but the first will fail:
// First example, bad sintax
$this-sql = "SELECT `city`,`address` FROM `users` WHERE `name` LIKE ':name'";
// Second example, good
$this-sql = "SELECT `city`,`address` FROM `users` WHERE `name` LIKE '%stefan' ";
I had thought of a solution ... Add quotes in like() method call and stripes it if the name is equal than a name of binded parameter binded in write():
private function write(array $input_parameters=array(),$style=NULL)
{
// clean possible errors in holders
foreach($input_parameters as $key => $value):
if(strpos($this->sql,"'".$key."'") !== FALSE)
$this->sql = str_replace("'".$key."'",$key,$this->sql);
if(strpos($this->sql,'"'.$key.'"') !== FALSE)
$this->sql = str_replace('"'.$key.'"',$key,$this->sql);
endforeach;
// .... code ....//
}
This solutions works fine in this case, but if you have something like this:
$userData =$crud
->select("id")
->from('blog')
->where('content')
->like(':word')
->_or('something')
->like(':word')
->read(array(':word','something'));
returns:
$this->sql = "SELECT `id` FROM `blog` WHERE `name` LIKE :word or `something` LIKE :word ";
This isn't a real life example, but its only for shows why i think its a bad solution, can become a security risk.
I cant find a way to binds data without secure problems, or damaged sql, i miss something here.
Can you think of anything else? I forgotten something? I'm paranoid? Now my head hurts so much, i cant think like a human.
Your help will be welcome, thanks