escaping quotes in a mysql insert statment

[alanv]

Hello, I'm having a problem with double quotes, @ symbols and # signs.
When a user submits a text field with those symboles for example, its cuts them off like so...

INSERT INTO po_item SET po_id='5304', descrip='10@9', price='0.0000'

the descrip should have more text after it but a double quote is killing the rest of the input data.
descrip="10@9"x 10/M' tt20y / donnick stock";

but as you can see the second set of quotes is killing it.

Currently i thought this was the solution but i guess i was wrong.

while(($key,$value)=each(%data)){
        $value=~ s/(["'])/\\$1/g;
        $query.=" $key='$value',";

i thought the $value line would escape those double quotes...anyone know what i should do

[eWish]

I would suggest something like so.
[CODE=perl]
my $insert = $dbh->prepare('INSER T INTO table(coulumn1) Values(?)');
$insert->execute($var1) ;[/CODE]
This will automatically escape any special characters in $var1. You can also use the quote function. Also, I believe that SET is used when updating a table not inserting new.

--Kevin