[SOLVED] Quote mark in MySQL query from text file

[hyeteck]

hey guys, im getting the following error.

# You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'S INTEGRATOR KIT', 'Allows Vutech screens to use standard po

 

i am reading data from a text file and trying to insert it into my database.

 

ok here is where the error is happening

$temp = mysql_query("INSERT INTO `products`(pID, pName, pSection, pDescription, pLongdescription, pImage, pLargeimage, pBrandimage, pBrandtext, pPrice, pWeight, pInStock, pDropship, pUPC) VALUES('$prodId', '$prodName', '$catId', '$prodDesc', '$prodDescl', '$prodImage', '$prodImagel', '$prodBrandi', '$prodBrandt', '0', '$prodWeight', '0', '1', '$prodUPC')") or die(mysql_error());

 

its happening due to my text file.  at the following line from the textfile.

IP-Enabled Remote Control Kit	1.90VUTEC SYSTEM'S INTEGRATOR KIT	<li>Allows Vutech screens to use standard potocols or IP 

thats a snippet from my text file on where the error is happening.  I think the quote mark in the word SYSTEM'S is causing the issue.  What can i put in my code so that it doesn't interpret the quote mark as the end of data for that variable or column thats being set?

[skali]

After you read parameters from file pass all the variables through a filter of addslashes() function that will add slashes with all the quotes and double quotes and then you can pass the variables to the query. This should fix your problem.