 <p>Use this:</p> <pre><code>if (get_magic_quotes_gpc()) { $skill = stripslashes($row['skill']); $skill = mysql_real_escape_string($skill); } else { $skill = mysql_real_escape_string($row['skill']); } $sql = 'select * from table where column = "' . $skill . '"'; </code></pre> <p>EDIT: Sorry, I've just realised that <code>$row['skill']</code> probably hasn't come from GET/POST/COOKIE and so <code>get_magic_quotes_gpc()</code> is probably irrelevant. Just go straight for the <code>stripslashes()</code>:</p> <pre><code> $skill = stripslashes($row['skill']); $skill = mysql_real_escape_string($skill); $skill = mysql_real_escape_string($row['skill']); </code></pre>