SECURITY

Learn about these things:

For additional security and error prevention always declare(strict_types=1); and use TYPE CASTING for INTEGERS coming from user inputs.

Use TYPE CASTING

When taking in a value with $_GET then one step for hardening the system would be using type casting:

$id = (int) $_GET['id'];

$stmt = $pdo->prepare("SELECT * FROM `notes` WHERE `id` < {$id}");

Of course this is not going to stop all SQL attacks, but it will limit it. But aside of DB connections TYPE CASTING will harden the system a lot.
Never combine or insert user input directly into SQL statements.

PS! SQL injections are super big SECURITY ISSUE and therefore should be taken very seriously. PDO uses placeholders