PHP/mysql website cms problem

[netadmin]

For the new website we are hoping to implement sometime soon at our school, I have developed a php/mysql powered content management system. It works good, except anytime single quotation marks ' are used, it says "you have an error in your sql syntax. Please check the manual..."

 

I know the basic statement is ok, because I can save pages without the quotation marks. Is there somthing I need to do to allow these? Below is a sample from the php page that saves the page. I can tell something about the single quote triggers the error (I am guessing it is ending the sql statement halfway through, but have no clue how to rewrite it properly).

 

Thanks for any help.

 

A note:

-$ta is the name of the CMS textbox

 

   if (isset($_POST['submitcontent'])) { 
    $ta = $_POST['ta'];
    $pagename = $_POST['pagename'];
}

    $sql = "UPDATE cms SET 
            content='$ta'
            WHERE pagename='$pagename'"; 
      if (@mysql_query($sql)) { 
      //include ('head.php');
      echo('
Edit Page
[b]Page saved successfully.[/b][/b]'); 
     include 'template/foot.php';

[EeEk]

Id have wrote it like

 

$sql = "UPDATE cms SET

content='{$ta}'

WHERE pagename='{$pagename}'";

 

Or

 

$sql = "UPDATE cms SET

content=".$ta."

WHERE pagename=".$pagename;

 

None of which may be the correct/best way but if it works its good enough for me

 

Whats going to be in the $ta textbox ? you might have to deal with ' / etc . Check http://uk2.php.net/manual/en/function.mysql-real-escape-string.php

 

which can be include in the query like..

 

$sql = "UPDATE cms SET

content=".mysql_real_escape_string($ta)."

WHERE pagename=".$pagename;

[webman]

Have a look at addslashes().

[netadmin]

Thank you to both EeEk and webman for your help.

I tried all of your suggestions and addslashes worked the best.

 

For future reference to anyone else that has this problem, below is how I corrected the code to make it work without errors:

 

$data_slashes = addslashes($ta);

$sql = "UPDATE cms SET 
content='{$data_slashes}'
WHERE pagename='{$pagename}'";

 

 

Thanks again for the help.