title: Why won't mysql_real_escape_string() work?
body: <p>I'm trying to write someting into the DB using PHP but if I try to use mysql_real_escape_string() I don't get any errors but nothing gets saved into the DB and I don't know why =/ specially because I did the same on another PHP file and it worked perfectly...</p>
  
  <pre><code>&lt;?php
  if(isset($_POST['reporte']))
      $falla = $_POST['reporte'];
  else      
      $falla = "";
  
  if(!isset($falla)){
      echo '&lt;font color="red"&gt;Intentó enviar una forma vacía. Por favor intente de nuevo.&lt;/font&gt;';
  }else{
  $fecha = mysql_real_escape_string(stripslashes($_POST['fecha']));
  $usuario = mysql_real_escape_string(stripslashes($_POST['usuario']));
  
  connection...
  
   $sql = "INSERT INTO $tbl_name(usuario, comentario, fecha, estado) VALUES('$usuario','$falla','$fecha', '0')" or die('mysql_error()'); 
  </code></pre>
  
  <p>now I don't check if "fecha" or "usuario" are empty since they are sent via a hidden field in the form.</p>
  
  <hr>
  
  <p><strong>Edit</strong></p>
  
  <p>I did the switch there's still no error and nothing gets into the db =/ I'm looking at the documentation, but I'm puzzled because I've done this before the exact same way and it worked...haha...</p>
  
  <hr>
  
  <p><strong>Edit 2</strong></p>
  
  <p>Yes I have a </p>
  
  <pre><code>mysql_query($sql) or die('Error SQL !'.$sql.'&lt;br&gt;'.mysql_error()); 
  </code></pre>
  
  <p>Yes I've set the $tbl_name along with the connection in:</p>
  
  <pre><code>$host="localhost"; 
  $username="user"; 
  $password="pass"; 
  $db_name="cosa"; 
  $tbl_name="reportes"; 
  </code></pre>
  
  <p>and I've done the check in the database monitor and printed it...it returns OK... however, what do you mean by "sanitizing" $falla? I recognize the injection, but I'm quite new with php per se.</p>
  
  <hr>
  
  <p><strong>Edit 3</strong></p>
  
  <p>I use die just to test, however there are no errors displayed it functions smoothly just won't insert a thing if I use "mysql_real_escape_string()"</p>
  
  <hr>
  
  <p><strong>Edit 4</strong></p>
  
  <p>This is my current code:</p>
  
  <pre><code>&lt;?php
  if(isset($_POST['reporte']))
      $falla = $_POST['reporte'];
  else      
      $falla = "";
  
  if(!isset($falla)){
      echo '&lt;font color="red"&gt;Intentó enviar una forma vacía. Por favor intente de nuevo.&lt;/font&gt;';
  }else{
  
      $host="localhost"; // Host name
      $username="user"; // Mysql username
      $password="pass"; // Mysql password
      $db_name="cosa"; // Database name
      $tbl_name="reportes"; // Table name
  
      // To protect MySQL injection
      $fecha = mysql_real_escape_string(stripslashes($_POST['fecha']));
      $usuario = mysql_real_escape_string(stripslashes($_POST['usuario']));
      $falla = mysql_real_escape_string(stripslashes($falla));
  
      $db = mysql_connect($host, $username, $password) or die('Cannot Connect '.mysql_error()); 
       mysql_select_db($db_name) or die('Cannot select DB '.mysql_error());
  
      $sql = "INSERT INTO $tbl_name(usuario, comentario, fecha, estado) VALUES('$usuario','$falla','$fecha', '0')" or die('mysql_error()');
  
      mysql_query($sql) or die('Error SQL !'.$sql.'&lt;br&gt;'.mysql_error());
  
      header("location:../../user/usuario.php"); 
      mysql_close();    
  }  
  ?&gt;
  </code></pre>
  
  <p>That's the complete one, and also changed according to the recommendations I've been getting here...still not getting anything into the DB...</p>