[RESOLVED] Inserting form html

[talkster5]

Hi,
I am currently building an order system and need a little help with this part of the script. What I am doing is editing the paypal form link so that when the user adds a price to the database it will automatically create the paypal form as well. The only problem I am having is that I can not get the html to insert into the database as it just says that I have an error in my SQL syntax where the first URL is as the form action. Can you tell me what is wrong please.

<?php require_once('../connections/database.php');

session_start();
if(!session_is_registered("admin")) {
header("Location: login.php");
exit;
}

$game = $_POST['game'];
$type = $_POST['type'];
$slots = $_POST['slots'];
$price = $_POST['price'];

$manual = "<form action='https://www.paypal.com/cgi-bin/webscr' method='post'>
<input type='hidden' name='cmd' value='_xclick'>
<input type='hidden' name='business' value='[e-mail]'>
<input type='hidden' name='item_name' value='Net-Play Service'>
<input type='hidden' name='item_number' value='1'>
<input type='hidden' name='amount' value=' $price '>
<input type='hidden' name='no_note' value='1'>
<input type='hidden' name='currency_code' value='GBP'>
<input type='image' src='https://www.paypal.com/en_US/i/btn/x-click-but01.gif' border='0' name='submit' alt='Make payments with PayPal - it's fast, free and secure!'>
</form>";

mysql_select_db($database, $connect);
$sql = "INSERT INTO prices SET game='$game', type='$type', slots='$slots', price='$price', manual='$manual'";
mysql_query($sql) or die(mysql_error()); 
header("Location: prices.php");
?>

[drew010]

run [man]addslashes[/man] or better yet [man]mysql_real_escape_string[/man] on all the fields you are adding to the database before you insert them. for one this will fix that error as its complaining about the ' in the string, since you are enclosing your sql fields in ', and also it can help eliminate sql injection attacks.

[talkster5]

drew010 wrote:

run [man]addslashes[/man] or better yet [man]mysql_real_escape_string[/man] on all the fields you are adding to the database before you insert them. for one this will fix that error as its complaining about the ' in the string, since you are enclosing your sql fields in ', and also it can help eliminate sql injection attacks.

Thanks that worked great.