"Ramzi S. Abdallah" wrote:

My mail interface stripped off the script, so I wasn't able to take a look at what you're doing. However, that sounds like a pretty standard problem. You can choose from a couple of solutions: call DBI->quote() on the string to be written to the database, or use "?" placeholders in your "prepare" statement. For example, if you have a script segment reading something like: $q = "INSERT INTO that_table VALUE (\"$name\", \"$address\")"; $sth = $dbh->prepare($q); $rv = $sth->execute(); you can replace it with: $q = "INSERT INTO that_table VALUE (?,?)"; $sth = $dbh->prepare($q); $rv = $sth->execute($name. $address); Using this technique, the DBI library (and the DBD modules it calls) are responsible for quoting the strings where needed, and usually do a good job of it. In the first code snippet, if the $address variable contained "13 Becker's Ridge" the statement would die - if you don't check it for an error return code, you'd never know it. Passing the same data to the second snippet will work - DBI will take care or escaping the '.