Question

Or the call to real_escape_string() in such cases is not needed?
/Email value comes from user input./

function findUser($email)  
{   
    $mysqli = connectDB();  
    $email = $mysqli->real_escape_string($email);  
    $query = "CALL FindUser('{$email}')";  
    // ...  
}  

Answer 1

You are just building a dynamic SQL string that contains a procedure call, which can be attacked. You should bind parameters to the procedure, which gives you some protection, as long as you do not use dynamic SQL within the procedure.

mysqli_stmt::bind_param

Bound Parameters