fix two typos in QueryBuilder, on of them reported in #3479

It was possible to provide escaping through the second argument but that
was more like a hack.

Replaced the code examples for `set()` to show that the value parameter is not escaped and thus could pose an SQL injection vulnerability.

Fix PSR2 rules : "As per PSR2, the static declaration should come after the visibility declaration."