php - Syntax error or access violation: 1064 ' brandname -

i'm getting error in magento script:

product not added exception:exception 'pdoexception' message

'sqlstate[42000]: syntax error or access violation: 1064 have error in sql syntax; check manual corresponds mysql server version right syntax use near 's secret'' @ line 1'

some background info:

i have php script running on cron job add , update products. runs while now, got error. think it's because manufacturers name got apostrophe in it. have no clue how fix it.

changing manufacturer's name not option.

function addmanufacture($pid,$men){     $resource = mage::getsingleton('core/resource');     $readconnection = $resource->getconnection('core_read');     $query = "select manufacturers_id p1_manufacturers m_name='".$men."'";     $lastid = $readconnection->fetchone($query);      $write = mage::getsingleton("core/resource")->getconnection("core_write");     if($lastid){}else{     $url = createurl($men);      $query = "insert p1_manufacturers (m_name,identifier,status) values ('".$men."','".$url."',1)";     $write->query($query);     $lastid = $write->lastinsertid();     }     $query1 = "insert p1_manufacturers_products (manufacturers_id,product_id) values ('".$lastid."','".$pid."')";     $write->query($query1);      $query3 = "select manufacturers_id p1_manufacturers_store manufacturers_id='".$lastid."'";     $mid = $readconnection->fetchone($query3);      if($mid){} else {     $query2 = "insert p1_manufacturers_store (manufacturers_id,store_id) values ('".$lastid."',0)";     $write->query($query2);     }  } 

here problem:

$query = "select manufacturers_id p1_manufacturers m_name='".$men."'"; 

replace with:

$menescaped = mysql_real_escape_string($men); $query = "select manufacturers_id p1_manufacturers m_name='".$menescaped."'"; 

for readability, might inclined reformat thus:

$menescaped = mysql_real_escape_string($men); $query = "     select         manufacturers_id             p1_manufacturers             m_name='{$menescaped}' "; 

the problem not escaping input variables, , if comes user input, may find people injecting sql of own choice database. , that's not good!

addendum: above may work, i've spotted using library called mage. being case, need find out how escape strings using library - $write->escapestring($men).

as has been noted in comments, better if can switch paramerisation. you'll need check if library supports that.