Tukukkk

I have this code to display a counter on the side of <i class="fas fa-bell mr-3"></i>. I want to know if this code is good on security and perfomance.

I just started using jquery and ajax, i had heard people saying that someone could disable the javascript and do bad things. What you guys think about my code?

 <div>

    <ul class="navbar-nav textoPerfilDesk dropMenuHoverColor">

        <li class="nav-item dropdown pr-2 dropleft navbarItem ">

        <a class="nav-link dropdown-toggle-fk" href="#" id="navbarDropdownMenuLink" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">

            <i class="fas fa-bell mr-3"></i>

        </a>

        <div class="dropdown-menu dropdown-menu-fk py-3" aria-labelledby="navbarDropdownMenuLink">

            <a class="dropdown-item dropMNitemNT" href="um-link">

            <span class="d-flex">

                <img class="imgNT" src="img/1.jpg">

                <span class="pl-2 pt-1">

                    titutlo

                </span>

            </span>

            </a>

        </div>

        </li>

    </ul>

    <span class="text-white divCountNT" id="datacount"></span>

  </div>

script:

<script>

  $(document).ready(function(){

     var intervalo, carregaDiv;

     (carregaDiv = function(){

        $("#datacount").load('select.php', function(){

           intervalo = setTimeout(carregaDiv, 1000);

        });

     })();

     $('.fa-bell').on('click', function (){

        clearTimeout(intervalo);

        $.ajax({

           url: "update.php",

           complete: function(){

             setTimeout(carregaDiv, 1000);

           }

        });

     });

  });

</script>

select.php

<?php

require_once 'db.php';



if(!isset($_SESSION))session_start();



if(isset($_SESSION['userid'])) {

  $userid = $_SESSION['userid'];

}



    $status = 'unread';



    $sql = $conn->prepare("SELECT * FROM noti WHERE status = :status AND 

    userid = :userid");

    $sql->bindParam(':userid', $userid, PDO::PARAM_INT);

    $sql->bindParam(':status', $status, PDO::PARAM_STR);

    $sql->execute();

    $countNT = $sql->rowCount();



    echo $countNT;



    $conn = null;



    ?>

update.php

<?php

require_once 'db.php';



if(!isset($_SESSION))session_start();



if(isset($_SESSION['userid'])) {

  $userid = $_SESSION['userid'];

}



$status = 'read';

$sql = $conn->prepare("UPDATE noti SET status = :status WHERE userid = :userid");

$sql->bindParam(':user_id', $userid, PDO::PARAM_INT);

$sql->bindParam(':status', $status, PDO::PARAM_STR);

$sql->execute();

$countNT = $sql->rowCount();



echo $countNT;



$conn = null;

?>