where am I doing in this query?
$sql=$wpdb->prepare("SELECT * FROM `wp_postmeta` WHERE `meta_key`='_favorites' AND `post_id` = '$post_id'");
where am I doing in this query?
$sql=$wpdb->prepare("SELECT * FROM `wp_postmeta` WHERE `meta_key`='_favorites' AND `post_id` = '$post_id'");
Placeholders are used to replace variables.
What I don't get, why you had $post_id in single quotes, they aren't needed for numbers
so use
$sql=$wpdb->prepare( "SELECT * FROM `wp_postmeta` WHERE `meta_key` = '_favorites' AND `post_id` = %d", $post_id );