Apostrophes preventing database record

[datoshway]

For some crazy reason if any of my entries in the form fields have an Apostrophe in it, the data record is not recorded.  Any ideas on a fix?  Here is the code that deals with the database insert on my process file.

 

	  $db_host = "localhost"; $db_user = "XXX";$db_pass = "XXX";$db_name = "XXX";$db_table = "XXX";
$link = mysql_connect($db_host,$db_user,$db_pass);
if(!$link) die ('Could not connect to database: '.mysql_error());
mysql_select_db($db_name,$link);
$query = "INSERT into `XXX` (Name,Address,CityStateZip,Phone,School,SchoolAddress,Grade,Subject,Statement,Brand,Vendor,Referral,Age,Gender,Email) VALUES ('" . $_POST['Name'] . "','" . $_POST['Address'] . "','" . $_POST['CityStateZip'] . "','" . $_POST['Phone'] . "','" . $_POST['School'] . "','" . $_POST['SchoolAddress'] . "','" . $_POST['Grade'] . "','" . $_POST['Subject'] . "','" . $_POST['Statement'] . "','" . $_POST['Brand'] . "','" . $_POST['Vendor'] . "','" . $_POST['Referral'] . "','" . $_POST['Age'] . "','" . $_POST['Gender'] . "','" . $_POST['Email'] . "')";
mysql_query($query);
mysql_close($link);
    }

[fenway]

It's not crazy -- you're not escaping your string.

[datoshway]

How would you recommend setting that up based on the code I posted?

 

[datoshway]

Got it, never mind, it should look like;

 

 

mysql_real_escape_string($_POST['Statement'])