title: Security vulnerabilities in code to insert and return last inserted row number
body: <p>I have the following code which is supposed to insert a row into a DB table "clicks" (consisting 1 Primary AI column "id" and another column "user" which contains the user's sessions id) upon clicking the Like button. For each user assuming they have a session id set from a login I would like to return to them their most recently inserted id from the table. So the first time the button is clicked it will return 1 etc.
  I would like this to be accessible to multiple users through a login system. I was wondering if there are any major security vulnerabilities with my code e.g can the results be forged etc?</p>
  
  <p>index.php:</p>
  
  <pre><code>&lt;?php
  include 'init.php';
  include 'connect.php';
  ?&gt;
  &lt;!doctype html&gt;
  &lt;html&gt;
  &lt;body&gt;
      &lt;?php       
      $userid = $_SESSION['user_id'];
     echo '&lt;a class="like" href="#" onclick="like_add(', $userid,   
    ');"&gt;Like&lt;/a&gt;';
      ?&gt;
      &lt;script type ="text/javascript" src="jquery-1.11.1.min.js"&gt;&lt;/script&gt;
      &lt;script type ="text/javascript" src="like.js"&gt;&lt;/script&gt;      
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>connect.php:</p>
  
  <pre><code>&lt;?php  
  $servername = "localhost";
  $username = "root";
  $password = "";
  $dbname = "DB";
  $conn = new mysqli($servername, $username, $password, $dbname);
  
  if ($conn-&gt;connect_error) {
  die("Connection failed: " . $conn-&gt;connect_error);
  }
  ?&gt;
  </code></pre>
  
  <p>init.php:</p>
  
  <pre><code>&lt;?php
  session_start();
  $_SESSION['user_id']='1';
  $userid = $_SESSION['user_id'];
  include 'connect.php';
  include 'like.php';
  ?&gt;
  </code></pre>
  
  <p>like.js:</p>
  
  <pre><code>function like_add(userid) {
  $.post('like_add.php', {userid:userid}, function(data) {
     if (data == 'success'){
      add_like($userid);
     } else{
         alert(data);
     }
  });
  }
  </code></pre>
  
  <p>like.php:</p>
  
  <pre><code>&lt;?php
  function add_like($userid){
  include 'connect.php';
  
  $stmt = $conn-&gt;prepare("INSERT INTO clicks (user) VALUES (?)");
  $stmt-&gt;bind_param("s", $userid);
  
  $stmt-&gt;execute();
  $stmt = $conn-&gt;prepare("SELECT max(id) FROM clicks WHERE user=?");
  $stmt-&gt;bind_param("s", $userid);
  $stmt-&gt;execute();
  $stmt-&gt;bind_result($click);
  $stmt-&gt;fetch();
  echo $click;
  $stmt-&gt;close();
  }
  ?&gt;
  </code></pre>
  
  <p>like_add.php:</p>
  
  <pre><code>&lt;?php
  include 'init.php';
  if (isset($userid)) {
  $userid = $userid;
  add_like($userid);
  }
  ?&gt;
  </code></pre>