On a site of mine, http://www.wheelandtireoutfitters.com/, I have an issue where I sort by state, but I have to use quotes in the url... http://www.wheelandtireoutfitters.co...9;GA'.html .... is there a way i can make this work without using quotes in my php...below is my code.

PHP Code:

$query_sitelist = "SELECT * FROM listings WHERE state_id=" . $state_id . " ORDER BY name"; 


can anyone help me with this issue, it would be very appreciated.

Thanks,
Brett Adams

Strings must be quoted in SQL:

PHP Code:

$query_sitelist = "SELECT * FROM listings WHERE state_id='" . $state_id . "' ORDER BY name"; 


thanks, i knew it was something simple

ba

Remember to check that any user input doesn't have quote in it, otherwise people can
send strings like "'; delete * from listings " and ruin your database remotely

how would i go about preventing that?

http://us2.php.net/manual/en/functio...ape-string.php

Thank you, I will go over that and implement it.