Question

I have a PHP script that is inserting a record into a database after getting the data from a user-filled form. I developed on my local machine (WAMP server) and have the following code in my PHP script:

$name = mysql_real_escape_string($_POST['name']);
        $email = mysql_real_escape_string($_POST['email']);

        //connecting to db
        mysql_connect("host", "user", "pass") or die('save_failed');
        mysql_select_db("db") or die('save_failed');

        //inserting into table
        mysql_query("INSERT INTO table(name, email) VALUES('" . $name . "', '" . $email . "' ) ") 
        or die('save_failed');  

The script worked just as expected and the records were being successfully inserted into the table.

As soon as I moved the script to my webserver, I realized the values being stored in the database were empty strings. Removing mysql_real_escape_string fixed this.

Why is it that mysql_real_escape_string won’t work on my webserver?

The database I’m working on hasn’t changed. Even when developing locally, I was hitting my webserver DB.
PHP ver on localhost is 5.3.8 while on the webserver it is 5.2.

Does PHP 5.2 not support mysql_real_escape_string, and if so what is the alternative?

Answer 1

Put mysql_connect("host", "user", "pass") or die('save_failed'); before mysql_real_escape_string.