for the right syntax to use near '

Prøv lige:

$sqlstr = "INSERT INTO products (prod_number,prod_name,prod_picture,prod_desc,prod_quantity,prod_price,prod_weight,prod_features,prod_date,prod_KatId,prod_SubKatId)
    VALUES ('{$_POST['prod_number']}','{$_POST['prod_name']}','$path_1','{$_POST['prod_desc']}','{$_POST['prod_quantity']}','{$_POST['prod_price']}','{$_POST['prod_weight']}','{$_POST['prod_features']}',NOW(),'{$_POST['KatId']}','".$_POST["SubKatId$KatId"]."')";
echo $sqlstr;
mysql_query ($sqlstr) or die(mysql_error());

og fortæl os hvad den SQL streng indeholder.

indeholder følgende:

Sti til billede: INSERT INTO products (prod_number,prod_name,prod_picture,prod_desc,prod_quantity,prod_price,prod_weight,prod_features,prod_date,prod_KatId,prod_SubKatId) VALUES ('920-001374','Logitech DiNovo Keyboard for Notebooks [sep08]','/Shop/images/Logitech-920-001374-12kb.jpg','Add this stylish, full-sized keyboard with integrated number-pad to your notebook-based workspace, and enjoy enhanced performance along with the flexibility of a portable solution. Design - Modern, elegant design: Add an element of style to any notebook-based workspace, with an ultra-slim profile, piano-black finish, and brushed-aluminum palm rest. Performance - Stand-alone freedom: Use this performance keyboard with any Logitech mouse and notebook stand, so you can type and work in a position that's most comfortable for you. - Our longest-lasting battery life: Three-year battery life minimizes the hassle of changing batteries. A flashing battery-indicator light alerts you when your batteries are low. - Powerful, reliable connection: Logitech's advanced 2.4 GHz wireless technology dramatically reduces interference and features an extremely fast data rate, virtually no delays or dropouts, and encryption for advanced security. Enjoy all the benefits of a cord with the convenience of cordless. Comfort - Premium typing experience: Logitech's PerfectStroke™ key system with precision micro-scissors makes each keystroke comfortable, fluid, and silent. - Integrated number pad: Enjoy fast and effortless data entry.','4','300','1200','0',NOW(),'38','194')You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's PerfectStroke™ key system with precision micro-scissors makes each keystroke c' at line 2

Logitech's

indeholder en ' og så går det galt !

Prøv i første omgang med noget mysql_real_esape_string.

Og senere skift så til mysqli og prepared statement.

øøh, hvordan gør jeg lige det :-)
Har ikke fået lavet noget PHP, mysql i 1 års tid så skal lige opfriskes.

Der er eksempler i docs:
  http://www.php.net/manual/en/function.mysql-real-escape-string.php

kan ikke rigtig få det til at virker, har prøvet med flere forskellige opsætninger, men kan ikke rigtig komme videre.

$sqlstr = "INSERT INTO products (prod_number,prod_name,prod_picture,prod_desc,prod_quantity,prod_price,prod_weight,prod_features,prod_date,prod_KatId,prod_SubKatId)
    VALUES ('" . mysql_real_escape_string($_POST['prod_number']) . "','" . mysql_real_escape_string($_POST['prod_name']) . "','$path_1','" . mysql_real_escape_string($_POST['prod_desc']) . "','" . mysql_real_escape_string($_POST['prod_quantity']) . "','" . mysql_real_escape_string($_POST['prod_price']) . "','" . mysql_real_escape_string($_POST['prod_weight']) . "','" . mysql_real_escape_string($_POST['prod_features']) . "',NOW(),'" . mysql_real_escape_string($_POST['KatId']) . "','" . mysqæ_real_escape_string($_POST['SubKatId$KatId']) . "')";
echo $sqlstr;
mysql_query ($sqlstr) or die(mysql_error());

Det virkede jo, manglede lige ", tak, smide et svar

svar kommer her