[AndreT]

Yeah, you have to sanitize all input from users.

Also, why not use mysql_format introduced in R6-2?

pawn Код:

new query[256];
mysql_format(1, query, "SELECT * FROM mytable WHERE mystring = '%e' AND myint = %d", mystring, myint);
mysql_query(query);