Possibility of SQL injection by static or predefined values

Question

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters.

$result->bindParam(":id",$_POST['id'],PDO::PARAM_INT)

but I am confused regarding the following situation, I have to use parameter or parameter doesn't roll in here.

Situation-1

When calling function

function fetch($id, $subid){
    $result=$con->prepare("SELECT * FROM......WHERE id=$id AND subid=$subid")
    $result->execute();
    .....
}

If we put static value in code, no user input, what about injection here?

fetch(3,4);

Situation-2

Variable come from another query

//first-query
$id = $row['id']

//second-query where first query variable is used
$result1=$con->prepare("SELECT * FROM......WHERE id=$id")

//Another Example

$id=$con->lastInsertId();    
$result1=$con->prepare("SELECT * FROM......WHERE id=$id")

Here we use variable associated with a direct database.

Answer 1

Situation-1

It's a function. Which means it could be called with different parameters and you cannot foretell whether these will be predefined or not.

Besides, I just don't understand why you're asking at all. Is a prepared statement that hard to use to make you seek a shortcut for a deliberately rare use case?

Then ask how to make a prepared statement easier to use. It's not a rocket science and will make your code as simple as

function fetch($id, $subid){
    $sql = "SELECT * FROM...WHERE id=? AND subid=?";
    return $this->con->run($sql, [$id,$subid])->fetch();
}

so there will be just no reason to avoid a prepared statement.

Situation-2

This is called a "second order SQL injection", and being the very reason to use a prepared statement for any variable, regardless of the source.