How are you inserting the data in the SQL query?
It sounds like you aren't properly sanitizing incoming data. Note that user-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors (as you're seeing). Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (for string data).