Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters.
$result->bindParam(":id",$_POST['id'],PDO::PARAM_INT)
but I am confused regarding the following situation, I have to use parameter or parameter doesn't roll in here.
Situation-1
When calling function
function fetch($id, $subid){
$result=$con->prepare("SELECT * FROM......WHERE id=$id AND subid=$subid")
$result->execute();
.....
}
If we put static value in code, no user input, what about injection here?
fetch(3,4);
Situation-2
Variable come from another query
//first-query
$id = $row['id']
//second-query where first query variable is used
$result1=$con->prepare("SELECT * FROM......WHERE id=$id")
//Another Example
$id=$con->lastInsertId();
$result1=$con->prepare("SELECT * FROM......WHERE id=$id")
Here we use variable associated with a direct database.