php - Best Way To Show User Their Photo -

okay wondering best way show user own photo , if way safe or should change.

url:

http://localhost/project/everyone/myphoto.php?num=2 

php code:

$user_id = $_session['user_id'];  if (isset($_get['num'])) {     $num = $_get['num'];      if ($stmt = $dbconn->prepare("select 1 t_photos id ='$num' , user_id ='$user_id' limit 1")) {         $stmt->execute();         $stmt->store_result();          $rows = $stmt->num_rows;         if ($rows === 1) {             $stmt = $dbconn->prepare("select url,uploaddate t_photos id = ?");         $stmt->bind_param('i', $num); // bind "$email" parameter.         $stmt->execute(); // execute prepared query.         $stmt->store_result();         $stmt->bind_result($photopath, $uploadtime); // variables result.         $stmt->fetch();         } else {             $error2 = "error 2 fuck";             require 'notfound.php';             die();         }     } } 

html & php code :

<div id="pathwrap">     <div class="photowrap">         <?php if (isset($photopath)) {         echo '<img src="' . $photopath . '">';         } ?>     </div> </div> 

this how pdo , exception style:

function requestcurrentuserphoto(){ if( !isset($_get['num']) ){     throw new exception('bad request. generated link missing prop num.'); } if( !isset($_session['user_id']) ){     throw new exception('bad request. generated link linked guest.'); } $sth = $dbh->prepare('select url,uploaddate t_photos id = :id , user_id = :user_id limit 1'); $sth->execute(array(     ':id' => (int) $_get['num'],     ':user_id' => (int) $_session['user_id'] )); $result = $sth->fetch(pdo::fetch_assoc); if( $result === false ){     throw new exception('bad request. generated link linked non-existence photo or unauthorized user.'); } //optional... if( empty($result['url']) || empty($result['uploaddate']) ){     throw new exception('bad database table row. there invalid photo row in t_photos'); } return $result; } 

this code should safe. , should check if code related got errors.