I agree with @Magictallguy if you aren't using the prepared statements then just do a straight up query.
I typically don't prepare "safe" variables, like things directly pulled out of a database which have been correctly cast, but it's good practice to prepare everything just in case something slips through the gaps π