SQL Injection when not using variables
Since the SQL query is just a fixed string, there is no chance for SQL injection.

However, the way you print the output is a concern, because you fail to escape it for HTML.  For example, if one of the subsubcat_names contains a &lt; character, then it might be interpreted as an HTML tag.

In the worst case, if subsubcat_name contains a malicious string like &lt;script&gt;while (true) alert("Ha ha");&lt;/script&gt;, it would be executed by the browser as JavaScript.  Cross-site scripting attacks like that can be used, for example, to steal login credentials.

To prevent such accidental or malicious breakage, you should call htmlspecialchars():

echo htmlspecialchars($row['subsubcat_name']);


Even if the subsubcat_names are not under user control, it's still good programming practice to ensure correctness by escaping all HTML output as HTML.