error in your SQL syntax

I get the following error when i try to input a large chunk of text into a text box that updates a table in my database:

PHP Code:

---

Error in submission:You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 's five-year MCS, Hunt five-year soft-sided fleet, and Hunt/Aver 


---

it works fine with a few sentences but i want to update the small sentences into a large paragraph.

am i doing something wrong???

this is what the table settings are:

specification longtext Yes NULL

and its basically this code:

PHP Code:

---

<textarea name="specification" cols="71" rows="6"><?php echo $specification ?></textarea>

---

PHP Code:

---

if (isset($submit)) {
  // UPDATE QUERY CODE WHEN SUBMIT IS ENTERED
$insert = "UPDATE car SET
make='$make', model='$model', price='$price', specification='$specification', sold='$sold' WHERE ID='$ID'";

if (@mysql_query($insert))
{
?>
            <script language="javascript">
document.location.replace('edited.php');
             </script>
<?
}
else {
echo('Error in submission:' . mysql_error() . "<br /><br />" . $sql);
}
}
 ?>

---

and its the specification by the way.

thanks in advance for anyone willing to help me out.

try updating the table oneby one

tried that but ended up making it worse.

It is possible that the script has not received the variables correctly.
Force the script to show the sql sintax:

PHP Code:

---

echo('Error in submission:' . mysql_error() . "<br /><br />" . $insert); 


---

Note that the variable you must show is $insert.

you might be passing illegal characters to the database, trying using addslashes()

Quote:

---

Originally Posted by jpinedo

It is possible that the script has not received the variables correctly.
Force the script to show the sql sintax:

PHP Code:

---

echo('Error in submission:' . mysql_error() . "<br /><br />" . $insert); 


---

Note that the variable you must show is $insert.

---

i did that and got:

PHP Code:

---

Error in submission:You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'll find how to get in touch with us on our contact us page.', s

UPDATE car SET make='Scitex', model='UltraVu® II 3360', price='110,000', specification=' Romans of St. Albans stock at any one time at least 50 prestige and performance quality cars. All our pre owened cars are prepared to the highest standard and, before offered to our customers, are serviced and undergo a 70 point RAC check. Furthermore we are also in a position to offer new vehicles at fantastic savings. If you are looking to sell your quality prestige car please click here to fill out our enquiry form. We are also able to offer our clients an excellent after-sales service, encouraging customers to bring back their vehicles to be serviced by our on-site qualified technicians. Please browse through our website and view our stocklist of more than 50 quality cars (including photos of each individual car). We are confident, that you will find a vehicle to your requirements, if so you might want to book a test-drive on-line or alternatively you'll find how to get in touch with us on our contact us page.', sold='No' WHERE ID='3' 


---

Quote:

---

Originally Posted by webgodjj

you might be passing illegal characters to the database, trying using addslashes()

---

im only a .php newbie, can you explain more please :blush:

ok...
So you must do what webgodjj said.
see also:
http://www.php.net/addslashes
http://www.php.net/mysql-real-escape-string

read them but im lost to where i have to do this addslashes() thing..

i figured out that it works if i remove all illegal characters like '

so the addslashes will work..

maybe add $specification = stripslashes($specification);
before your insert?