Slightly change 2 lines to make your code more secure:

OLD:
$sql = "select list_id from campaign_list where campaign_id = $campaig
+n_id";

NEW:
$sql = "select list_id from campaign_list where campaign_id = ?";

OLD:
$sth->execute();

NEW:
$sth->execute($campaign_id);
[download]

Because $campaign_id comes from the user it is very dangerous to use in a database query unless it is properly handled and placeholders (the ? thingy) does that for you.