I have built a PHP API which queries data from some tables in an online SQL database. The credentials with which it connects to the database are saved in another file, and are loaded at start. The user with those credentials has SELECT priviledge only. The Android app just connects to the link and gets the data, so the API has no input at all. The queries are prewritten in the PHP script. The data in the database is all public, so if something else that's not in the script is read that's not so much of a problem.
How vulnerable is this setup to SQL Injection? (or other threats)