Calling a MySQL procedure with an arbitrary parameter on a GoDaddy website
As a rule of thumb in code security if you don't know what attacks you've secured your code from then it is not secure.  At least you're considering that your code might have issues and looking to remedy them when many don't.

Basically consider the ID 7254872364;drop table users;// or some variant - what SQL statement is that going to produce as a string and is it what you thought would get?  I should get that will get through real_escape_string quite nicely.

One thing that will help is to rewrite your code to use prepared statements.  They are not a magic bullet (nothing is) but they will give you code that is an order of magnitude more secure than you have today.

These questions on Security StackExchange should make for some interesting further reading:-


SQL injection — but why isn't escape quotes safe anymore?
Are prepared statements 100% safe against SQL injection?


[Edit: Sorry, missed that your host doesn't provide support for prepared statements.  GoDaddy do support it but you have to enable it in the control panel.  See Enable MYSQL-PDO in godaddy windows server and if you can't get it solved it might be best to tell GoDaddy where to go]

It's a good practice to assume that all user input is hostile until it you've established otherwise, which doesn't seem to be happening in this code.  Sanitize anything that comes from outside your system at every point of entry interaction including those pesky Url parameters, fields, cookies - at some point the odds are that it will be hostile.  If the ID's will take a certain form (x digits for example) then validate them and stop processing with an error if that validation fails.