Since the SQL query is just a fixed string, there is no chance for SQL injection.
However, the way you print the output is a concern, because you fail to escape it for HTML. For example, if one of the subsubcat_name
s contains a <
character, then it might be interpreted as an HTML tag.
In the worst case, if subsubcat_name
contains a malicious string like <script>while (true) alert("Ha ha");</script>
, it would be executed by the browser as JavaScript. Cross-site scripting attacks like that can be used, for example, to steal login credentials.
To prevent such accidental or malicious breakage, you should call htmlspecialchars()
:
echo htmlspecialchars($row['subsubcat_name']);
Even if the subsubcat_name
s are not under user control, it's still good programming practice to ensure correctness by escaping all HTML output as HTML.