I'm deploying a PHP project, and I always try to use prepared statements, but unfortunately, GoDaddy does not have the mod mysqlnd which I use it for the function mysqli_stmt_get_result($stmt), so I had to start using mysqli_query in order to use the classic.Example:while($row = mysqli_fetch_array($query,MYSQLI_ASSOC)){   echo $row['Name'];}I've been using mysqli_query, but I'm not expert in security, so could you please evaluate or give me some tips?<?php    include '../session.php';   include '../connection.php';   $link = mysqli_real_escape_string($connection,$_GET['file']);   $query = mysqli_query($connection,'CALL mostrarConvocatoriaLink('.$link.')');   if(!$query){     echo mysqli_error($connection);   }   else{     $row = mysqli_fetch_array($query,MYSQLI_BOTH);     extract($row);   }   mysqli_close($connection);?>This is used to get an entry on my database using a procedure (which is only a Select statement) but, we're using a random generated string to create the links, instead of using the ID of the page. This is for using a kind of a WordPress that we're creating for the project. In my project all the inserts are with prepared statements and using Post, but in this case, I create a <a href=template.php?file=[the random string]>. I wanna know if I'm screwing things up.
Calling a MySQL procedure with an arbitrary parameter on a GoDaddy website
mysql;php5;mysqli;sql injection