 <pre><code>SELECT * FROM articles, articles_cat_main WHERE articles.id = %s AND ... </code></pre> <p>And %s is replaced with the content of a variable called $colname_article. Based on the name of that variable, I don't think it contains an integer, that can be inserted there without quotes. </p> <p>If it is either empty or contains a string without quotes, it will result in the syntax error you saw.</p> <p>Please note that this kind of dynamic SQL statements is prune to have <a href="http://en.wikipedia.org/wiki/SQL_injection" rel="nofollow">SQL injection</a> vulnerabilities.</p>