You're right. This code is not parameterized and would be prone to SQL injection attacks. However, the parameterization of the queries is not that difficult; easier than string concatenation. You escape the parameter areas and then provide the values for the parameters.
$query = $db->prepare('SELECT * FROM users WHERE uid = ?');
$query->execute([$userId]);
As you see, the string concatenation is removed and instead a simple escaped character is used. Try to rewrite the query, and if that doesn't work, we can help. :-) Read more: [PHP: Prepared Statements - Manual](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) [MySQLi: Bind in Execute - PHP 8.1 • PHP.Watch](https://php.watch/versions/8.1/mysqli\_stmt\_execute-params)
The shit I complain about It's like there ain't a cloud in the sky and it's raining out - Eminem ~! Firewall !~