[Dayrion]

You need to use ' on a string, yes. Also, use '%e' specifier instead of '%s' when you use mysql_format. It escape your query from injections and other stuffs like that.