Is there a PHP security exploit with $_POST in my code?
Since you validate that $_POST['surveyid'] contains at least one digit and contains only digits, your query is safe.

However, the CREATE TABLE operation that you are trying to do strikes me as a horrible thing to do.  CREATE TABLE is a Data Definition Language operation, and DDL commands should be executed only in special situations.

Basically, if you routinely create a new table to store responses from each survey, your database schema will be an unmaintainable mess.  I strongly recommend that you post your database schema and describe what you are trying to do in a question to http://dba.stackexchange.com to develop a sane schema that does not require new tables to be created routinely.