title: if database query param is not user submitted but from database does it have to escaped?
body: <p>Pretty simple really,</p>
  
  <p>If I pull an array from a database and then use a value from that array, say an auto increment field, do I have to use a prepared statement on that query or will I be safe using a normal sql query as the value cannot change of the variable and I know it will not be a sql injection attack. Same goes for is the variable is set in a session?</p>