 <p>Unescaped quotes inside quotes</p> <p>This</p> <pre><code>$sql = pg_query("SELECT title FROM books WHERE ownedby=("$user_id")"); </code></pre> <p>Should be</p> <pre><code>$sql = pg_query("SELECT title FROM books WHERE ownedby='$user_id'"); </code></pre> <p>Or</p> <pre><code>$sql = pg_query("SELECT title FROM books WHERE ownedby=\"$user_id\""); </code></pre>