Fix SQL injection in low security level

[r1kka6]

Summary

• require numeric user ids before querying the low-level SQLi endpoint
• replace string interpolation with parameterized queries for both MySQL and SQLite backends

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/sqli/source/low.php
• vulnerable baseline returns multiple user rows for id=1' OR '1'='1
• patched runtime returns no rows for the injection payload and still returns the expected row for id=1