Asegurar la inyección SQL para mis archivos PHP [cerrado]

He hecho un foro de PHP. Utilicé PDO, así como SQLi. Cuando realicé un análisis de seguridad de mi sitio web, encontré errores y, después de un largo tiempo de intentar diferentes cosas, no puedo solucionarlos.

Puntos para quien me ayude a arreglarlos.

Recibí los siguientes errores:

inyección de sql
Entrada de clasificación: error de validación
Recurso: view_topic.php
Parámetro: id
Método: GET

inyección de sql
Entrada de clasificación: error de validación
Recurso: add_answer.php
Parámetro: a_email
Parámetro: a_answer
Parámetro: a_name
Parámetro: id
Método: GET

Desbordamiento de enteros
Clasificación: Error de condición de contorno
Recurso: view_topic.php? Id = 2147483647
Parámetro: id
Método: GET

Desbordamiento de enteros
Clasificación: Error de condición de contorno
Recurso: view_topic.php? Id = 2147483647
Parámetro: id
Método: GET

Secuencias de comandos entre sitios
Clasificación: Error de validación de entrada
Recurso: view_topic
Recurso: /add_answer.php
Parámetro: id
Método: GET

ARCHIVOS PHP
add_answer.php

<?php

$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password="linux"; // Mysql password 
$db_name="simpleFourm"; // Database name 
$tbl_name="fanswer"; // Table name 

// Create connection
$conn = new mysqli($host, $username, $password, $db_name);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}


// Get value of id that sent from hidden field 
$id=$_POST['id'];

// Find highest answer number. 
$sql="SELECT MAX(a_id) AS Maxa_id FROM $tbl_name WHERE question_id='$id'";
$result = $conn->query($sql); 

$rows=mysqli_fetch_array($result);

// add + 1 to highest answer number and keep it in variable name "$Max_id". if there no answer yet set it = 1 
if ($rows) {
$Max_id = $rows['Maxa_id']+1;
}
else {
$Max_id = 1;
}

// get values that sent from form 
$a_name=$_POST['a_name'];
$a_email=$_POST['a_email'];
$a_answer=$_POST['a_answer']; 

$datetime=date("d/m/y H:i:s"); // create date and time

// Insert answer 
$sql2="INSERT INTO $tbl_name(question_id, a_id, a_name, a_email, a_answer, a_datetime)VALUES('$id', '$Max_id', '$a_name', '$a_email', '$a_answer', '$datetime')";
$result2 = $conn->query($sql2); 

if($result2){
echo "Successful<BR>";
echo "<a href='view_topic.php?id=".$id."'>View your answer</a>";

// If added new answer, add value +1 in reply column 
$tbl_name2="fquestions";
$sql3="UPDATE $tbl_name2 SET reply='$Max_id' WHERE id='$id'";
$result3 = $conn->query($sql3); 

}
else {
echo "ERROR";
}

// Close connection
$conn->close();
?>

view_topic.php

<?php

$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password="linux"; // Mysql password 
$db_name="simpleFourm"; // Database name 
$tbl_name="fquestions"; // Table name 

// Create connection
$conn = new mysqli($host, $username, $password, $db_name);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// get value of id that sent from address bar 
$id=$_GET['id'];
$sql="SELECT * FROM $tbl_name WHERE id='$id'";
$result = $conn->query($sql); 

$rows=mysqli_fetch_array($result);
?>

<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td><table width="100%" border="0" cellpadding="3" cellspacing="1" bordercolor="1" bgcolor="#FFFFFF">
<tr>
<td bgcolor="#F8F7F1"><strong><?php echo $rows['topic']; ?></strong></td>
</tr>

<tr>
<td bgcolor="#F8F7F1"><?php echo $rows['detail']; ?></td>
</tr>

<tr>
<td bgcolor="#F8F7F1"><strong>By :</strong> <?php echo $rows['name']; ?> <strong>Email : </strong><?php echo $rows['email'];?></td>
</tr>

<tr>
<td bgcolor="#F8F7F1"><strong>Date/time : </strong><?php echo $rows['datetime']; ?></td>
</tr>
</table></td>
</tr>
</table>
<BR>

<?php

$tbl_name2="fanswer"; // Switch to table "forum_answer"
$sql2="SELECT * FROM $tbl_name2 WHERE question_id='$id'";
$result2  = $conn->query($sql2);

if ($result2->num_rows > 0) {
    // output data of each row
    while($rows = $result2->fetch_assoc()) {
?>

<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td><table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td bgcolor="#F8F7F1"><strong>ID</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_id']; ?></td>
</tr>
<tr>
<td width="18%" bgcolor="#F8F7F1"><strong>Name</strong></td>
<td width="5%" bgcolor="#F8F7F1">:</td>
<td width="77%" bgcolor="#F8F7F1"><?php echo $rows['a_name']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Email</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_email']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Answer</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_answer']; ?></td>
</tr>
<tr>
<td bgcolor="#F8F7F1"><strong>Date/Time</strong></td>
<td bgcolor="#F8F7F1">:</td>
<td bgcolor="#F8F7F1"><?php echo $rows['a_datetime']; ?></td>
</tr>
</table></td>
</tr>
</table><br>

<?php
  }
} else {
    echo "<font color='red'>0 results</font>" ; 

}


$sql3="SELECT view FROM $tbl_name WHERE id='$id'";
$result3 = $conn->query($sql3);

$rows=mysqli_fetch_array($result3);


$view=$rows['view'];

// if have no counter value set counter = 1
if(empty($view)){
$view=1;

$sql4="INSERT INTO $tbl_name(view) VALUES('$view') WHERE id='$id'";
$result4 = $conn->query($sql4);

}

// count more value
$addview=$view+1;
$sql5="update $tbl_name set view='$addview' WHERE id='$id'";
$result5  = $conn->query($sql5);
$conn->close();
?>

<BR>
<table width="400" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<form name="form1" method="post" action="add_answer.php">
<td>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td width="18%"><strong>Name</strong></td>
<td width="3%">:</td>
<td width="79%"><input name="a_name" type="text" id="a_name" size="45"></td>
</tr>
<tr>
<td><strong>Email</strong></td>
<td>:</td>
<td><input name="a_email" type="text" id="a_email" size="45"></td>
</tr>
<tr>
<td valign="top"><strong>Answer</strong></td>
<td valign="top">:</td>
<td><textarea name="a_answer" cols="45" rows="3" id="a_answer"></textarea></td>
</tr>
<tr>
<td>&nbsp;</td>
<td><input name="id" type="hidden" value="<?php echo $id; ?>"></td>
<td><input type="submit" name="Submit" value="Submit"> <input type="reset" name="Submit2" value="Reset"></td>
</tr>
</table>
</td>
</form>
</tr>
</table>