DB and php select random and pass variable

Question

I've done a module for Joomla 3, it's work but some time no, these module extract, with a function, a random user on line from tab session, then pass the variable to another function, to retrieve the avatar, and id skipe, its work but seems he extract random also the avatar from the user on line, meanwhile I have seen this process can bind a lot of work the db is there a way to lighten, another person told me that there could be security issues, I think due to the fact that the id of skipe is clear!

<?php

class modUno
{

public static function due()
{

$db = JFactory::getDBO();   
$query = "SELECT userid AS memTotal FROM #__session ORDER BY RAND() LIMIT 1;";      
$db->setQuery($query);
$result = $db->query();
return $result->fetch_object()->memTotal;
$mysqli->kill($db);
}

public static function tre()
{

$risultato = modUno::due();

$db = JFactory::getDBO();
$query = "SELECT avatar FROM #__comprofiler WHERE id = '{$risultato}'; ";
$db->setQuery($query);
$result = $db->loadResult();
return $result; 
$mysqli->kill($db);
} 

public static function quattro()
{

$risultato = modUno::due();

$db = JFactory::getDBO();
$query = "SELECT cb_skipe FROM #__comprofiler WHERE id= '{$risultato}'; ";
$db->setQuery($query);
$result = $db->loadResult();
return $result; 
$mysqli->kill($db);
} 
}
?>

Answer 1

Try using the following:

<?php

class modUno {

    public static function due() {

        $db = JFactory::getDbo();
        $query = $db->getQuery(true);
        $query->select($db->quoteName('userid') . 'AS' . $db->quoteName('memTotal'))
              ->from($db->quoteName('#__session'))
              ->order('RAND()')
              ->setLimit(1);
        $db->setQuery($query);
        return $db->loadResult();

    }
    public static function tre() {

        $risultato = due();     
        $db = JFactory::getDbo();
        $query = $db->getQuery(true);
        $query->select($db->quoteName('avatar'))
              ->from($db->quoteName('#__comprofiler'))
              ->where($db->quoteName('id') . ' = ' . $db->quote($risultato));
        $db->setQuery($query);
        return $db->loadResult();

    } 
    public static function quattro() {

        $risultato = due();     
        $db = JFactory::getDbo();
        $query = $db->getQuery(true);
        $query->select($db->quoteName('cb_skipe'))
              ->from($db->quoteName('#__comprofiler'))
              ->where($db->quoteName('id') . ' = ' . $db->quote($risultato));
        $db->setQuery($query);
        return $db->loadResult();

    } 

}
?>

I have made some modifications however have not tested it so please let me know if it works or not.