SQL Injection without direct user input

Question

In order to prevent SQL Injection for my site, i have used prepared statements.

Now let's say i use somewhere in my code, a simple SQL query like this :

    SELECT  DATA FROM DATABLE;

Is this code prone to injection ? Well it seems to me that's not possible to be, as there is no user input.But i just want to be sure.

Answer 1

If your statement is fixed (has no outside parameters), then it is immune to injection.

So if your code looks something like this:

result = RunQuery("SELECT * FROM Table")

then you are safe, since the query will always be the same everytime and cannot be influenced by users.

Answer 2

Inject is only possible if you use a variable in your query.

If you use prepaired statements with params it is not possible.

select * from user where id = ?

You cannot change this query, only the value, in that case you will just get no results

If you use

select * from user where id = '$id'

now depending on the value of $id we can have a sql inject. If $id would be "0' or id > 0 " you will allways login ;)