PHP/mysql insert problem

PHP
1

Hi guys,

I am writing a small CMS type script and I am taking user input from a textarea.

It works for most stuff but some times I think it recognizes the input as some sort of SQL query.

I’m not sure because I am a php/mysql newbie.

All help will be greatly appreciated.

Error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘s Executive Box, and and take the applause of the crowd at half-time!’)’ at line 1

Post News Function

function postNews($contents)
{
	global $conn;
	$txt = html2txt($contents); //removes html for security reasons
	$sqlstatement = "insert into news(contents) VALUES ('$txt')";
	$sqlresult = mysql_query($sqlstatement, $conn) or die(mysql_error());
}
2

$contents is user input? My guess is, it contains a single quote. Use mysql_real_escape_string to sanitize it before using it in a query.