Sql Syntax Error when i did serveral checks

[LongWei]

Hi All,

I have a select list in my HTML page as follows

<select name="category[]" size="3" multiple="multiple" id="category">
        <option value="Family">Family</option>
        <option value="Cartoons">Cartoons</option>
        <option value="Scenary">Scenary</option>
        <option value="Photographs">Photographs</option>
      </select>

Then i have a small script to get the values from the above, parse into an SQL statment and query for results

if (isset($_POST['category'])) {
  $category = $_POST['category'];
}
 
$categoryq ="";
 
for($categoryarray=0; $categoryarray < sizeof($category); $categoryarray++)
{
if($categoryarray < (sizeof($category)-1)) { $category_cond = " OR "; }
else { $category_cond = ""; }
$categoryq = $categoryq."image_category LIKE
'".$category[$categoryarray]."'$category_cond";
}
 
mysql_select_db($database_ImageGallart, $ImageGallart);
 
$query_rstImages =sprintf("SELECT * FROM images WHERE '".$categoryq."';");
 
$rstImages = mysql_query($query_rstImages, $ImageGallart) or die(mysql_error());
 
$row_rstImages = mysql_fetch_assoc($rstImages);
 
$totalRows_rstImages = mysql_num_rows($rstImages);

for example if i select cartoons and familt together i get the below error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Family' OR image_category LIKE 'Cartoons''' at line 1

Any ideas where i gone wrong?

[code green]

echo out the query then the error will be visible

[LongWei]

thats the error that i got

SELECT * FROM images WHERE 'image_category = 'Family' OR image_category = 'Cartoons''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Family' OR image_category = 'Cartoons''' at line 1

i dun find anything wrong with the systax. where can i get wrong?

[LongWei]

arhh, now i think i know where i gone wrong

the ' quotes in my sql statment. But how do i remove the single quote under this sql statement?

echo $query_rstImages =sprintf("SELECT * FROM images WHERE '".$categoryq."'");

[Dormilich]

with mysql_real_escape_string()