Problem with parsing when inserting into mysql

[nita]

Hallo

 

I'm having a problem inserting $messageorder into mysql datebase.  Otherwise works good. So there is no problem with database itself or mysql command too.

I suspect there must be something in this code that mysql doesnt like. Also have to say that im able to sent email with $messageorder.

 

Please take a look at the codee.

 

$messageorder = "\r\n" . 'Order:' . 
                    '<br><br><table>' . "\r\n";


$result3 = mysql_query("SELECT * FROM orderslist WHERE supplier='$supplier'") or die(mysql_error());
	$data = array();
	$data['' . $row3['id']] = $_POST['' . $row3['id']];

	while($row3=mysql_fetch_array($result3))
	{
		$value = $_POST['' . $row3['id']];
	if ( $value == ""){

	} 
	else {

	$messageorder .= "
	<tr>
    <td class='H4'><strong>$row3[name]</strong></td>
	<td class='H4' align='center'>$value</td>
	<td class='H4'>$row3[unit]</td>
	</tr>
	";
	}

}
$messageorder .= "</table>";	


echo $messageorder;

date_default_timezone_set('Europe/London');
$supplier=$_GET['order'];

$delivery=$_POST['delivery'];	
$timestamp = date("H:i:s");
$datestamp = date('Y/m/d');

mysql_query ("INSERT INTO orders (id, datestamp, timestamp, supplier, ordertext, delivery ) 

		  VALUES ('', '$datestamp', '$timestamp', '$supplier', '$messageorder', '$delivery')");

 

If someone could help to find a solution I will appriciate !

 

Thank you very much

[AyKay47]

use mysql_real_escape_string on $messageorder before attempting to use its value in the query.

[nita]

Thanks a lot AyKay47 !

 

Just added line below to my code before the query, and it works .. great !

 

$messageorder = mysql_real_escape_string($messageorder);	

mysql_query ("INSERT INTO orders (id, datestamp, timestamp, supplier, ordertext, delivery ) 

		  VALUES ('', '$datestamp', '$timestamp', '$supplier', '$messageorder', '$delivery')");

 

This really helps a lot, thanks one more time!