Is my code for a forum page vulnerable for sql injections? This is the backend code for the page where you upload a post. I have already tried to do a sql attack on this page, but it didn't work.

&lt;?php
include_once 'includes1/dbh.inc.php';
session_start();
//*skåd ifall man är inloggad *//
if (isset($_POST['topic_submit'])) {
    $newFileName = "annons"; //Här ska egentligen vara $_POST['topic_title'];//
    if (empty($newFileName)) {
        $newFileName = "annons";
    } else {
        $newFileName = strtolower(str_replace(" ", "-", $newFileName));
    }
        $cid = $_POST['cid'];
        $title = $_POST['topic_title'];
        $content = $_POST['topic_content'];
        $creator = $_SESSION['UserName'];
        $imageNamn = $_POST['filenamn'];
        $imageMail = $_POST['filemail'];
        $imageNummer = $_POST['filenummer'];
        $imagePris = $_POST['filepris'];
        $imagestad = $_POST['filestad'];

    $file = $_FILES['file'];

    $fileName = $file["name"];
    $fileType = $file["type"];
    $fileTempName = $file["tmp_name"];
    $fileError = $file["error"];
    $fileSize = $file["size"];

    $fileExt = explode(".", $fileName);
    $fileActualExt = strtolower(end($fileExt));

    $allowed = array("jpg", "jpeg", "png", "image/jpg");

    if (in_array($fileActualExt, $allowed)) {
        if ($fileError === 0) {
          if ($fileSize &lt; 2000000000) {
            $imageFullName = $newFileName . "." . uniqid("", true) . "." . $fileActualExt;
            $fileDestination = "img/gallery/" . $imageFullName;

            include_once 'includes1/dbh.inc.php';

            if (empty($title) || empty($content) || empty($imageNamn) || empty($imageMail) || empty($imagestad) || empty($imagePris)) {
                header("Location: ../index.php?upload=empty");
                exit();
            } else {
                $sql2 = "SELECT * FROM gallery;";
                $stmt = mysqli_stmt_init($conn);
                if (!mysqli_stmt_prepare($stmt, $sql2)) {
                    echo "SQL statement failed!";
                } else {
                    mysqli_stmt_execute($stmt);
                    $result2 = mysqli_stmt_get_result($stmt);
                    $rowCount = mysqli_num_rows($result2);

                    $sql = "INSERT INTO topics (category_id, topic_title, topic_creator, topic_date, topic_reply_date, imgFullNameGallery, topic_pris) VALUES ('".$cid."', '".$title."', '".$creator."', now(), now(), '".$imageFullName."', '".$imagePris."')";
                    $result = mysqli_query($conn, $sql);
                    $new_topic_id = mysqli_insert_id($conn);
                    $sql2 = "INSERT INTO gallery (category_id, topic_id, post_creator, titleGallery, descGallery, namnGallery, emailGallery, nummerGallery, prisGallery, stad, post_date, imgFullNameGallery)
                     VALUES ('".$cid."', '".$new_topic_id."', '".$creator."', '".$title."', '".$content."', '".$imageNamn."', '".$imageMail."', '".$imageNummer."', '".$imagePris."', '".$imagestad."', now(), '".$imageFullName."')";
                    $result2 = mysqli_query($conn, $sql2);
                    $sql3 = "UPDATE categories SET last_post_date=now(), last_user_posted='".$creator."' WHERE id='".$cid."' LIMIT 1";
                    $result3 = mysqli_query($conn, $sql3);
                    if (!mysqli_stmt_prepare($stmt, $sql2)) {
                        echo "SQL statement failed!";
                    } else {
                        mysqli_stmt_bind_param($stmt, "sssssssssss", $cid, $new_topic_id, $creator, $title, $content, $imageNamn, $imageMail, $imageNummer, $imagePris, $imagestad, $imageFullName);
                        move_uploaded_file($fileTempName, $fileDestination);

                        header("location: view_topic.php?cid=".$cid."&amp;tid=".$new_topic_id);          
                    }
                }
            }
        } else {
        echo "File size is too big!";
        exit();
        }
    } else {
    echo "You had an error!";
    exit();
    }
} else {
    echo "You need to upload a proper file type!";
    exit();
}
}
?&gt;
Yes, it is.
For some reason you put everything upside-down: where you don't need a prepared statement (for a constant query) you are using it, but where a prepared statement is mandatory - for a query that uses variables - you don't.
But I would say, it is not the main problem of this code. The main problem is this code being a total mess. There are two blocks of code that do absolutely nothing useful, one of them even fails, but you don't notice it.
I would review only a database interaction part
1. Useless code
The following block of code does absolutely nothing
            $sql2 = &quot;SELECT * FROM gallery;&quot;;
            $stmt = mysqli_stmt_init($conn);
            if (!mysqli_stmt_prepare($stmt, $sql2)) {
                echo &quot;SQL statement failed!&quot;;
            } else {
                mysqli_stmt_execute($stmt);
                $result2 = mysqli_stmt_get_result($stmt);
                $rowCount = mysqli_num_rows($result2);

it takes you $rowCount which is nowhere used. You can safely take this code away.
Another block,
                if (!mysqli_stmt_prepare($stmt, $sql2)) {
                    echo &quot;SQL statement failed!&quot;;
                } else {
                    mysqli_stmt_bind_param($stmt, &quot;sssssssssss&quot;, $cid, $new_topic_id, $creator, $title, $content, $imageNamn, $imageMail, $imageNummer, $imagePris, $imagestad, $imageFullName);

is also doing nothing useful (as you are already executed this query), and even fails on the bind_param part, because of the flawed
2. Error reporting
There are two things you are doing wrong in regard of error reporting

using procedural interface that silently fails on errors
checking the function results manually

To fix these issues, you have to use OOP syntax and add a specific command to your mysqli connection code,
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

(just for reference, here is a canonical example for mysqli connect I wrote).
After that, all MySQL errors will pop up automatically, therefore you won't have to check every function's result manually.
3. SQL injection.
Finally to the SQL injection. The rules are simple:

if your query doesn't accept any variables, then you don't have to run it using a prepared statement. Use a regular query() instead.
if your query accepts any variables, then it must be executed using prepared statement

Now you can see that if SELECT * FROM gallery had any meaning, you would have run it using query(), not a prepared statement. But as it is just useless, we won't run this query at all.
All other queries must be run using prepared statements:
$sql = &quot;INSERT INTO topics (category_id, topic_title, topic_creator, topic_date, topic_reply_date, imgFullNameGallery, topic_pris) 
        VALUES (?,?,?,now(), now(),?,?)&quot;;
$stmt = $conn-&gt;prepare($sql);
$stmt-&gt;bind_param(&quot;sssss&quot;, $cid, $title, $creator, $imageFullName, $imagePris);
$stmt-&gt;execute();
$new_topic_id = mysqli_insert_id($conn);

$sql = &quot;INSERT INTO gallery (category_id, topic_id, post_creator, titleGallery, descGallery, namnGallery, emailGallery, nummerGallery, prisGallery, stad, post_date, imgFullNameGallery)
         VALUES (?,?,?,?,?,?,?,?,?,?,?)&quot;;
$stmt = $conn-&gt;prepare($sql);
$stmt-&gt;bind_param(&quot;sssssssssss&quot;, $cid, $new_topic_id, $creator, $title, $content, $imageNamn, $imageMail, $imageNummer, $imagePris, $imagestad, $imageFullName);
$stmt-&gt;execute();

$sql = &quot;UPDATE categories SET last_post_date=now(), last_user_posted=? WHERE id=? LIMIT 1&quot;;
$stmt = $conn-&gt;prepare($sql);
$stmt-&gt;bind_param(&quot;ss&quot;, $creator, $cid);
$stmt-&gt;execute();

move_uploaded_file($fileTempName, $fileDestination);
header(&quot;location: view_topic.php?cid=&quot;.$cid.&quot;&amp;tid=&quot;.$new_topic_id);