I wrote some code which uses information from database to change content of various files and write something back to database afterwards.
This code is completly written in php and gets executed when I call a specific URL (htaccess protected).
Are there any security issues this could bring with it?
Probably relevant php-functions I use:
mysqli_connect($servername, $username, $password, $dbname);
Those are the functions I could imagine being "unsafe".
All the files are on a server!
Any tips on making it safer?
EDIT - trying to give important information: So I have a virtual server with various domains. On one of the domains there are folders with various files, which are created by a software. Those are different xml files and a html file. I need to add codesnippets to all html files.
For some other reasons I have the filepath stored in a database. My file (complete php) has a function which gets called when I open the url where my file lays and uses the above said functions to change the html files. There is nothing users can add or anything. My file just gets triggered --> executes --> changes files/db and gives me some information back on as html, whether the changes were successfull or not.
So my full "work procedure" is like this: create the html+xml with my software upload those on ftp put some information into database call the url to the php-file to edit my html-file(s) in the way I want.
As mentioned I have to enter htacces before I can trigger the php-file and only me and collegues know the path to the php-file.