testing mysql_real_escape_string

<?php
// Connect
$link = mysql_connect($_ENV["DB_PORT_3306_TCP_ADDR"], $_ENV["DB_ENV_MYSQL_USER"], $_ENV["DB_ENV_MYSQL_PASSWORD"]) OR die(mysql_error());
mysql_select_db($_ENV["MYSQL_ENV_MYSQL_DATABASE"], $link);

// Query
$lastname  = "O'Reilly";
$_lastname = mysql_real_escape_string($lastname, $link);

if ( isset($_GET['insert']) ) {
    mysql_query ( sprintf("INSERT INTO comments (`comment`) VALUES ('%s')", $_lastname) , $link );
}

$query = "SELECT * FROM comments WHERE comment LIKE '%$_lastname%'";

echo '<pre>';
var_dump($_lastname);
var_dump($query);

$result = mysql_query($query, $link);
if (!$result) {
    $message  = 'Invalid query: ' . mysql_error() . "\n";
    $message .= 'Whole query: ' . $query;
    die($message);
}
while ($row = mysql_fetch_assoc($result)) {
    var_dump($row);
}