How is this MySQL query vulnerable to SQL injection?

select
	ss.*,
	se.name as engine,
	ss.last_run_at + interval ss.refresh_frequency day as next_run_at,
	se.logo_name
from
	searches ss join search_engines se on ss.engine_id = se.id
where
	ss.user_id='.$user_id.'
group by ss.id
order by ss.project_id, ss.domain, ss.keywords

$db_connection = new mysqli("localhost", "user", "pass", "db");
$statement = $db_connection->prepare("SELECT thing FROM stuff WHERE id = ?");
$statement->bind_param("i", $user_id); //$user_id is an integer which goes
                                       //in place of ?
$statement->execute();