Hi Steve

It sounds like the data needs  "escaping"  before inserting into the database. Have a look at;

http://php.net/manual/en/function.mysql-real-escape-string.php

or this;

http://php.net/manual/en/function.addslashes.php

The apostrophe is one such character that needs to be treated before being saved to a SQL database. Escaping is the method of adding characters (e.g. '\') before any of the characters which have special meaning to the underlying software.

Hope this helps.

This is the code I've written to try and pass the data in using PHP.  However, the code fails and for the life of me I cannot figure out what is wrong with it.  I'm new at this, and while I understand what needs to be done, everything I try to actually do to make it work doesn't.

$name = $_POST["txtName"];
$email = $_POST["txtEmail"];
$address = $_POST["txtAddress"];
$total = $_POST["txtTotal"];
$comments = $_POST["txtComments"];
$location = $_POST["txtLocation"];
$GR = $_POST["txtGR"];

$con = mysql_connect("localhost","username","password");
mysql_select_db("databasename", $con);

$name = mysql_real_escape_string($name, $con);
$email = mysql_real_escape_string($email, $con);
$address = mysql_real_escape_string($address, $con);
$total = mysql_real_escape_string($total, $con);
$comments = mysql_real_escape_string($comments, $con);
$location = mysql_real_escape_string($location, $con);
$GR = mysql_real_escape_string($GR, $con);

$sql="INSERT INTO tablename (Name, Email, Address, Total, DORA, Comments, Location, GR, Day, Month, Year)
VALUES
('$name','$address','$total','$_POST[radDORA]','$comments','$location','$GR','$_POST[selDay]','$_POST[selMonth]', '$_POST[selYear]')";

$mysql_query =($sql, $conn);

The original code, that does pass the data in, but doesn't have an escape string reads like this:

$con = mysql_connect("localhost","username","password");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("databasename", $con);

$sql="INSERT INTO tablename (Name, Email, Address, Total, DORA, Comments, Location, GR, Day, Month, Year)
VALUES
('$_POST[txtName]','$_POST[txtEmail]','$_POST[txtAddress]','$_POST[txtTotal]','$_POST[radDORA]','$_POST[txtComments]','$_POST[txtLocation]','$_POST[txtGR]','$_POST[selDay]','$_POST[selMonth]', '$_POST[selYear]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }

mysql_close($con)

if anyone can help i'd be very appreciative.

Steve,

I'm no expert with PHP, but I note that you are using string expansion in the SQL query. Check to see if the code needs to sit within double quotes instead of single ones.

"$name" as opposed to '$name'

Also, as your SQL construction string is already within double quotes, then maybe you do not need quotes around an already quoted string held in your variables. Just a thought. I may have some time later to try and run your code myself.

Hope this helps.