Something

 $thisuser=intval($_GET['player']);
 if (isset($_GET['faction'])) {
  if ($_GET['faction']=="hero") {
   $factsql = "char_faction=\"H\"";
  }
  elseif ($_GET['faction']=="villain") {
   $factsql = "char_faction=\"V\"";
  }
  else {$factsql = "1";}
 }
 else {$factsql = "1";}
 if (isset($_GET['at']) && (intval($_GET['at'])>1) && (intval($_GET['at'])<14)) {
  $atsql = "char_at=".intval($_GET['at']);
 }
 else {$atsql="1";}
 $sql = "SELECT c.char_id, char_name, char_lvl, server_name, char_faction, char_at, at_desc, at_url, 
  COUNT( badge_id ) AS badge_count, COUNT( verified ) AS ver_count
  FROM characters AS c, servers AS s, char_badges AS cb, at
  WHERE cb.char_id = c.char_id
  AND c.char_server = s.server_id
  AND c.char_at = at.at_id
  AND user_id =?
  AND tracked =1
  AND $factsql AND $atsql
  GROUP BY char_id";
 $stmt = $mysqli->prepare($sql);
 $stmt->bind_param('i', $thisuser);