Since the SQL query is just a fixed string, there is no chance for SQL injection.
However, the way you print the output is a concern, because you fail to escape it for HTML. For example, if one of the
subsubcat_names contains a
< character, then it might be interpreted as an HTML tag.
In the worst case, if
subsubcat_name contains a malicious string like
To prevent such accidental or malicious breakage, you should call
Even if the
subsubcat_names are not under user control, it's still good programming practice to ensure correctness by escaping all HTML output as HTML.