I have an error in my syntax

[phpretard]

I don't get it.  The query before this one inserted and it basically has the same info.

 

Here is the error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Choice Award Winner * Named Best Muscle Car by Car and Driver's 10 Best Cars for' at line 8

 

Here is the query...

 

insert into class_listings ( owner, title, section, shortDescription, description, featured, price, display, hitcount, dateadded, expiration, notified, searchcount, repliedcount, pBold, pHighlighted, notes, orderID ) values( '6', 'FORD MUSTANG', '16', 'A Consumer Guide 2006 Best Buy * A contender for Motor Trend 2005 Car of the Year * MotorWeek 2006 Drivers' Choice Award Winner * Named Best Muscle Car by Car and Driver's 10 Best Cars for 2005 * AutoWeek named Mustang a finalist in the 2005 North American Car of the Year Awards *Named on the Automobile Magazine 50 Great New Cars List *', 'Clean CarFax vehicle history report-titled twice with no accident indicators. Fun to drive 5-speed manual transmission, luxurious leather, ABS, traction control, power driver's seat, interior upgrade package, and wheel locking kit. Ford Certified Pre-owned includes a 6 year/100,000 mile limited warranty with roadside assistance.', 'Y', '20995', 'Y', '0', '2010-10-29 17:20:11', '2010-11-29 17:20:11', 'N', '0', '0', 'Y', 'Y', 'NULL', '786' )

[kenrbnsn]

You have single quotes in the strings, which indicates you are not using mysql_real_escape_string on your data before creating the query.

 

Please post your code.

 

Ken

[phpretard]

My bad ... here is the code

 

$sql = "select * from class_car_types";
$getem = mysql_query($sql);
while ($cartype = mysql_fetch_assoc($getem)){

while (($data = fgetcsv($handle, 5000, ",")) !== FALSE){

$title = $data[3]." ".$data[4];

$sqlcat = "select * from class_car_types where make = '".$data[3]."' and model = '".$data[4]."'";
$querycat = mysql_query($sqlcat);

	while($getID = mysql_fetch_assoc($querycat)){
		$cat = $getID['cat'];

		$shortDescription = str_replace(",",",", $data[20]);
		$description = str_replace(",",",", $data[19]);

		$sqlinsert = "insert into class_listings
		(
		 owner, title, section, shortDescription, description, 
		 featured, price, display, hitcount, dateadded, expiration, 
		 notified, searchcount, repliedcount, pBold, pHighlighted, notes, orderID
		 )
  values(
		 '6', '$title', '$cat', '".stripslashes("$shortDescription")."', '".stripslashes("$description")."', 
		 'Y', '".$data[17]."', 'Y', '0', '".date('Y-m-d H:i:s')."', 
		 '$exp', 'N', '0', '0', 'Y', 'Y', 'NULL', '".rand(10,1000)."'
		 )
		"; 

		//echo "$sqlinsert<br /><br /><hr />";
		$sqlinsert1 = mysql_unbuffered_query($sqlinsert) or die(mysql_error());
	}

}


}
free($getem);
free($querycat);