Why do I get a error message when updating mySQL?

[vigour]

My PHP script is importing data from a XML file into mySQL. Why do I get a error message when I'm trying to import a text with ' (single quote) like this?

<Bildtext>Hans' f&#228;bodar i Gr&#228;sbo</Bildtext>

The error message tells me that:

You have an error in your SQL syntax; check the manual that corresponds to
your MySQL server version for the right syntax to use near 'f&#228;bodar i
Gr&#228;sbo', Lagring = '3', FotografID = '56', TekniskBildtyp = '1', Last ' at
line 1

This is a code fragment:

mysql_query("UPDATE helsingebilder_products SET bild = '$filnamn', Bildtext = '$Bildtext', Lagring = '$Lagring', FotografID = '$FotografID', TekniskBildtyp = '$TekniskBildtyp', Last = '$Last', ArtalNiva2ID = '$ArtalNiva2ID', LandskapID = '$LandskapID', KommunID = '$KommunID', SockenID = '$SockenID', ByOrtID = '$ByOrtID', GardPlatsID = '$GardPlatsID' WHERE BildID = '$BildID'") or die(mysql_error());

[leatherback]

because mysql does not know what is a variable and what is the delineator of your query elements.

You need to make sure all your quotes are properly 'slashed'. Use [man]mysql_real_escape_string[/man] on all variables that may have been tainted.

[vigour]

If I understand your answer correct, the single quote will be deleted if I use mysql_real_escape_string. I want to save it in mySQL, so I can get it back later.

[leatherback]

No they will not be deleted. Read the manual at the link I sent you.

[vigour]

Thanks for your great answer. It solved my problem. I can see the quote in mySQL now, it's saved as you said.

leatherback wrote:

No they will not be deleted. Read the manual at the link I sent you.