It does this: »The comma operator evaluates both of its operands (from left to right) and returns the value of the second operand.«

The groupname value has been assigned again in line 218 by user input and thus was not escaped yet. 

@raghunayyar correct me if i am wrong