REPLACE into database

[neroag]

Hi
Im using a small piece of code to insert a product title into the full description field of a database table

however the $fulldescr variable has html in that needs to remain intact when replacing it back into the database, is there a way i can replace the updated variable into the table field please without it giving errors regarding syntax error?

$fulldescr = substr_replace($fulldescr, $product_title, $fulldescr, 0);
db_query("UPDATE products SET fulldescr='$fulldescr' WHERE productid='$productid'");

many thanks

[bradgrafelman]

You should be properly sanitizing all data that's going into a SQL query, such as with a DB-specific string escaping mechanism (e.g. MySQLi's [man]mysqli_real_escape_string/man) for all string data.

[Killer54119]

thanks you bradgrafelman