Yeah, that was my immediate thought. Something like this:

$delete = "DELETE FROM `cart` WHERE id='$id'";

Which is currently among the top three, could be prefaced by the built in mysqli escape function or at minimum cast to (int).

This is not a great approach, the query should be prepared, but it's not inherently an injection risk based on that snippet alone.

And the underlying functions come from the C library for MySQL. Almost any language's SQL libraries will allow you to send an arbitrary string to the database. This is not a PHP problem by any measure.