SQL Injection when not using variables Do I still need to protect my code against SQL injection when I'm not using variables in SQL queries?

Is this code still vulnerable?:

$result = mysqli_query($connect,"SELECT subsubcat_name FROM subsubcategories WHERE subcat_ID = 4");
while ($row=mysqli_fetch_array($result)){
echo $row['subsubcat_name'];
echo '&lt;br&gt;';
}
Since the SQL query is just a fixed string, there is no chance for SQL injection.

However, the way you print the output is a concern, because you fail to escape it for HTML.  For example, if one of the subsubcat_names contains a &lt; character, then it might be interpreted as an HTML tag.

In the worst case, if subsubcat_name contains a malicious string like &lt;script&gt;while (true) alert("Ha ha");&lt;/script&gt;, it would be executed by the browser as JavaScript.  Cross-site scripting attacks like that can be used, for example, to steal login credentials.

To prevent such accidental or malicious breakage, you should call htmlspecialchars():

echo htmlspecialchars($row['subsubcat_name']);


Even if the subsubcat_names are not under user control, it's still good programming practice to ensure correctness by escaping all HTML output as HTML.