escaping in query??

[biscutty]

can anyone look at the escaping in my query?

$sql = "INSERT INTO thumbnails ( customerID, thumbNAME, thumbDATE)VALUES(\"$_SESSION[\'mycustID\']\",\"$file\",\"NOW()\")";

i seem to be going wrong with the session variable?

if someone could tell me whats wrong, and mabee point me to a good tutorial on escaping..

thanks

[goldbug]

Try using single quotes instead (instead of the \" stuff). (apostrophes)

EDIT: Actually, just for good measure, and my sanity, perhaps change it to this temporarily:

$sql = "INSERT INTO thumbnails (customerID,thumbNAME,thumbDATE) VALUES('" . $_SESSION['mycustID'] . "','" . $file . "',NOW())";

Might also be a good idea to escape those variables if needed, with addslashes().