How db_query works when I pass query parameter directly I have one doubt for db_query in drupal 7, as in documentation db_query syntax is like 

$result = db_query('SELECT n.nid, n.title, n.created
FROM {node} n WHERE n.uid = :uid', array(':uid' =&gt; $uid));


But what happens when I write query like.

$result = db_query("SELECT n.nid, n.title, n.created
FROM {node} n WHERE n.uid = $uid");



Is it still convert in PDO prepared statements?
Is it still reliable as first query?
Will it handle SQL injection?
According to Writing secure code for Drupal 8 (same for D7)

Use the database abstraction layer to avoid SQL injection attacks
Use the database layer correctly. For example, never concatenate data
directly into SQL queries.
Don't do this:
db_query('SELECT foo FROM {table} t WHERE t.name = '. $_GET['user']);

Instead, use proper argument substitution with db_query. The DB layer works on top of PHP PDO and uses an array of named placeholders:
db_query(&quot;SELECT foo FROM {table} t WHERE t.name = :name&quot;, [':name' =&gt; $_GET['user']]);