Prepare() does not do what most people think, unless WP did something, since they do sometimes override  how code normally acts. Prepare is vulnerable to 2nd order sql injection. http://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection. I highly reccommend against relying on is_numeric as your security measure. There is validation, which is_numeric does and then there is security for when the validation fails. Validation is not secure by itself.