[php & mySQL] advice

[b.rich]

I have a script that inserts variables into a database something like:

INSERT INTO `table_name` (`text1`,`text2`,`text3`,`text4`) VALUES ('$text1', '$text2', '$text3', '$text4')


as you can see it puts the variables directly into the database, now if one of those variables has a ' in it it would mess up the the sql statement. How should I avoid this? I was thinking of using str_replace and replace ' with \' but that doesn't work. Any Ideas? I know there is a simple solution I just can't think of it right now.

Thanks.

[b.rich]

after searching over at php.net I found htmlspecialchars I think that should work... lemme know if a better way exists.

thanks.

[amitgeorge]

you dont need to do anythjing ... php automatically does it for you.....