Fix SQL Injection Blind Low

[r1kka6]

Summary

• reject non-decimal id values before the Low blind SQL lookup
• use prepared statements in the MySQL and SQLite branches
• stop returning a distinct 404 transport signal for missing IDs while keeping the page feedback intact

Verification

• docker run --rm -v "$PWD":/app dvwa-ctf-xss-reflected-low php -l /app/vulnerabilities/sqli_blind/source/low.php
• docker build -t dvwa-ctf-sqli-blind-low .
• baseline: id=1%27+OR+%271%27%3D%271 returned 200 with User ID exists in the database.
• patched: the same payload returned 200 with User ID is MISSING from the database.
• baseline id=999 returned 404; patched id=999 returned 200 with the same missing-body response