[RESOLVED] Trouble with a mysql_query(); in PHP

[Madao]

I have this MySQL query...

$sql2= "INSERT INTO $tbl_name(question_id, a_id, a_name, a_email, a_answer, a_datetime) VALUES('$id', '$Max_id', '$a_name', '$a_email', '$a_answer', '$datetime')";
$result2=mysql_query($sql2, $dbLink);

It won't let me use a ' or a \ in a string. $result2 will return nothing if I do. Can anyone explain to me how I can insert strings with these in them?

[bradgrafelman]

User-supplied data should never be placed directly into a SQL query string else your code will be vulnerable to SQL injections and/or just plain SQL errors (as you're seeing). Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man (for string data) or use prepared statements.

Also note that the 'mysql' PHP extension is old and outdated; new PHP projects should instead be using something like [man]mysqli[/man], [man]PDO[/man], etc.

[Madao]

Thank you so much =)