Calling a MySQL procedure with an arbitrary parameter on a GoDaddy website I'm deploying a PHP project, and I always try to use prepared statements, but unfortunately, GoDaddy does not have the mod mysqlnd which I use it for the function mysqli_stmt_get_result($stmt), so I had to start using mysqli_query in order to use the classic.

Example:

while($row = mysqli_fetch_array($query,MYSQLI_ASSOC)){
   echo $row['Name'];
}


I've been using mysqli_query, but I'm not expert in security, so could you please evaluate or give me some tips?

&lt;?php 
   include '../session.php';
   include '../connection.php';
   $link = mysqli_real_escape_string($connection,$_GET['file']);
   $query = mysqli_query($connection,'CALL mostrarConvocatoriaLink("'.$link.'")');
   if(!$query){
     echo mysqli_error($connection);
   }
   else{
     $row = mysqli_fetch_array($query,MYSQLI_BOTH);
     extract($row);
   }
   mysqli_close($connection);
?&gt;


This is used to get an entry on my database using a procedure (which is only a Select statement) but, we're using a random generated string to create the links, instead of using the ID of the page. This is for using a kind of a WordPress that we're creating for the project. In my project all the inserts are with prepared statements and using Post, but in this case, I create a &lt;a href="template.php?file=[the random string]"&gt;. I wanna know if I'm screwing things up.
As a rule of thumb in code security if you don't know what attacks you've secured your code from then it is not secure.  At least you're considering that your code might have issues and looking to remedy them when many don't.

Basically consider the ID 7254872364;drop table users;// or some variant - what SQL statement is that going to produce as a string and is it what you thought would get?  I should get that will get through real_escape_string quite nicely.

One thing that will help is to rewrite your code to use prepared statements.  They are not a magic bullet (nothing is) but they will give you code that is an order of magnitude more secure than you have today.

These questions on Security StackExchange should make for some interesting further reading:-


SQL injection — but why isn't escape quotes safe anymore?
Are prepared statements 100% safe against SQL injection?


[Edit: Sorry, missed that your host doesn't provide support for prepared statements.  GoDaddy do support it but you have to enable it in the control panel.  See Enable MYSQL-PDO in godaddy windows server and if you can't get it solved it might be best to tell GoDaddy where to go]

It's a good practice to assume that all user input is hostile until it you've established otherwise, which doesn't seem to be happening in this code.  Sanitize anything that comes from outside your system at every point of entry interaction including those pesky Url parameters, fields, cookies - at some point the odds are that it will be hostile.  If the ID's will take a certain form (x digits for example) then validate them and stop processing with an error if that validation fails.