The post explicitly notes that the query, as presented, is not necessarily secure and is merely meant to give the reader the gist of what's going on. However,

The post explicitly notes that the query, as presented, is not necessarily secure and is merely meant to give the reader the gist of what's going on. However, in Correlated's case, it's not really an issue, because SQL injection is only a problem when $poll_id is a user input. But this particular query is only run by a user-inaccessible script.