Fix SQL Injection Low

[r1kka6]

Summary

• reject non-decimal id values before they reach the Low SQL lookup
• replace raw SQL string concatenation with prepared statements in both MySQL and SQLite branches
• preserve the normal id=1 lookup while preventing OR 1=1 style multi-row extraction

Verification

• docker run --rm -v "$PWD":/app dvwa-ctf-xss-reflected-low php -l /app/vulnerabilities/sqli/source/low.php
• docker build -t dvwa-ctf-sqli-low .
• baseline MySQL runtime: id=1%27+OR+%271%27%3D%271 returned all five users
• patched MySQL runtime: id=1 still returned admin, while the injection payload returned no rows

[r1kka6]

Closing as duplicate of #282; switching to a different Low challenge to avoid overlap.