Insert query problem with php mysql

Question

This is simple one i am using the following insert query

mysql_query(insert into table1 set saltval = 'Y'Z' where uid ='1');

but i does not work becaues the value for the field saltval is Y'Z . my question is how to considered this value is as a string .

Answer 1

You need to escape any single quotes with a backslash.

mysql_query("insert into table1 set saltval = 'Y\'Z' where uid ='1'");

However your SQL is invalid as well... Did you mean to do an update? Insert statements don't have a where.

As mentioned in other answers, if the input is from a user then you should use mysql_real_escape_string()
http://www.php.net/manual/en/function.mysql-real-escape-string.php

Answer 2

$string = mysql_real_escape_string("Y'Z");
mysql_query("insert into table1 set saltval = '{$string}' where uid ='1'");