$id should either be explicitly cast to int or type checked to be int. Otherwise we could potentially introduce a bug.
Also, I want to use named parameters for the prepared statements everywhere. That reduces potential abuse and risk of introducing bugs.