以下MySQL查询方式是否安全？

Question

$stmt= $conn->prepare("SELECT id, title FROM tbl_question where (topic_id = $old_id) and status=1 ORDER BY RAND() LIMIT $number_question");

实际上最佳做法是什么？