Dynamically inserting html from external file and updating the database

Question

I need some suggestions on how to approach this. I want to allow users to create sections of website. The code so far is working but since I am new to back-end I feel like there is better, more elegant way to approach this. I am open to any approaches, as long as the code is kept as concise as possible.

1. The user clicks "add section" button (there would be different types of sections to choose from), the html of each section will be stored in an external file
2. The id of the section should be inserted into the database (alongside some other details such as user uniqid)
3. The section should be inserted inside a div

At the moment this is how I have approached it:

if (isset($_POST["add_section"])) {
    $section_id = $_POST["add_section"];
    $stmt = $conn->prepare('INSERT INTO sections (user_id, section_id) VALUES (?, ?)');
    $stmt->bind_param('ss', $row['user_id'], $section_id);
    $stmt->execute();
}

---

The value of the button is the id of the section passed to the database.

<form method="post">
    <button class="button_1" value="navigation_ht" name="add_section>Seleccionar</button>
</form>

---

I want to allow the user to be able to include up to 3 sections.

$sql = "SELECT * FROM sections WHERE user_id = '{$row['user_id']}'";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    while($row = $result->fetch_assoc()) {
        include('shared/'.$row['section_id'].'.php');
    }
}

I was considering to do the following, but if the section is not created, there is error message:

$sql = "SELECT * FROM sections WHERE user_id = '{$row['user_id']}'";
$result = $conn->query($sql);
while($row = $result->fetch_assoc()) {
    include('shared/'.$row['section_id'].'.php');
    include('shared/'.$row['section_id'].'.php');
    include('shared/'.$row['section_id'].'.php');
}

Answer 1

This looks very clean, there is not much to improve upon.

However, there is a glaring security issue: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Your code should not allow malicious JavaScript to be stored inside of the db.