php-mysql database apostrophe and comma insertion -

i insert 10 field's value in mysql php code is. problem whenever user inserts apostrophe , comma(',) query code disturbed. functions there. necessary parse field's value these functions?? not time consuming :p

here php code

$rs = mysql_query("     insert          _{$pid}_item      values (         '$pid',         '$item_brand',         '$item_code',         '$item_name',         '$item_quantity',         '$item_mrp',         '$i‌tem_discount',         '$item_vat',         '$item_sat',         '$item_selling_price',         '$item_rating',         '$item‌​_image'     ) ");  

i passing values these variables..

try mysql_real_escape_string, or if using pdo, use pdo::quote.

and please please please read on sql injection attacks. not matter of getting failed queries, matter of having attacker access entire database, other user's information.

even better use prepared statements. this:

<?php //use of $pid in table name strange here (see comments section) , // dangerous unless you're generating entirely known information // sources. otherwise need sanitize it, don't think // prepared statements or quoting can do. $stmt = $dbh->prepare("     insert          :_{$pid}_item     values (         :pid,         :item_brand,         :item_code,         :item_name,         :item_quantity,         :item_mrp,         :i‌tem_discount,         :item_vat,         :item_sat,         :item_selling_price,         :item_rating,         :item‌​_image) ");   $stmt->bindparam(":pid", $pid); $stmt->bindparam(":item_brand", $item_brand); $stmt->bindparam(":item_code", $item_code); //... etc ... $stmt->execute();  ?>