Sql injection error

Hi all

I am getting an error when Ia m displaying certan Item from the database

"Fatal error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘’ at line 1
select * from national_category where id= in E:\working folder "

can any one help me why the error comes?

Thanks

Check it. Do an echo of $_GET[‘pname’] and see what it contains.
But are you sure ‘id’ is all that? I was expecting a number :smiley:

Anyway, baileylo is correct, please post your code. That way it’s easier to help you.

Could you post code.

I could tell you that it’s from the fact that you have an SQL error, but i’m pretty sure you’re aware of that ready.

select * from national_category where id=

This is your query. Do you see something is missing?

please have a look into my url

/product.php?pname=Metabo+18v+Li-Ion+1%2F4"+Hex+Cordless+Impact+Driver

there is double quotes in that.i think this is why i am getting an error
but how to remove this ?