title: I have a HTML form used to update content in my DB, if I type in a single quote in the input field of my form, the sql update fails
body: <p>I have a very simple form, when I type into the forms input fields, the data gets passed into a php script and it adds the data to my db. However if I enter something with a apostrophe or single quote, that breaks the query and the data does not get added into my db.</p>
  
  <p>Form Code</p>
  
  <pre><code>&lt;form method="POST" action="#"&gt;
  
          &lt;table&gt;
              &lt;tr&gt;
                  &lt;td&gt;&lt;label&gt;Title: &lt;/label&gt;&lt;br&gt;&lt;input type="text" name="title1" placeholder="&lt;?php echo htmlspecialchars($deal1title); ?&gt;"&gt;&lt;/td&gt;
              &lt;/tr&gt;
  
              &lt;tr&gt;
                  &lt;td&gt;
                      &lt;label&gt;Description: &lt;/label&gt;&lt;br&gt;&lt;textarea style="height: 200px;" name="desc1" placeholder="&lt;?php echo htmlspecialchars($deal1desc); ?&gt;"&gt;&lt;/textarea&gt;
                  &lt;/td&gt;
              &lt;/tr&gt;
  
              &lt;tr&gt;
                  &lt;td&gt;&lt;label&gt;Price: &lt;/label&gt;&lt;br&gt;&lt;input type="text" name="price1" placeholder="&lt;?php echo htmlspecialchars($deal1price); ?&gt;"&gt;&lt;/td&gt;
              &lt;/tr&gt;
  
              &lt;tr&gt;
                  &lt;td&gt;&lt;label&gt;Include: &lt;/label&gt;&lt;br&gt;&lt;input type="text" name="include1" placeholder="&lt;?php echo htmlspecialchars($deal1inc); ?&gt;"&gt;&lt;/td&gt;
              &lt;/tr&gt;
  
              &lt;tr&gt;
                  &lt;td&gt;&lt;label&gt;Not Include: &lt;/label&gt;&lt;br&gt;&lt;input type="text" name="notinc1" placeholder="&lt;?php echo htmlspecialchars($deal1noinc); ?&gt;"&gt;&lt;/td&gt;
              &lt;/tr&gt;
  
              &lt;tr&gt;
                  &lt;td&gt;&lt;input type="submit" name="submit1" value="Save"&gt;&lt;/td&gt;
              &lt;/tr&gt;
  
          &lt;/table&gt;
  
      &lt;/form&gt;
  </code></pre>
  
  <p>PHP Code</p>
  
  <pre><code>if(isset($_POST['submit1'])){
  
      $getTitle1=$_POST["title1"];
      $getDesc1=$_POST["desc1"];
      $getPrice1=$_POST["price1"];
      $getInc1=$_POST["include1"];
      $getNoInc=$_POST["notinc1"];
          //Set Title
          if(!empty($getTitle1)){
          mysqli_query($connect, "UPDATE specials SET title='$getTitle1' WHERE id=1");
          }
          //Set Description
          if(!empty($getDesc1)){
              mysqli_query($connect, "UPDATE specials SET description='$getDesc1' WHERE id=1");    
          }
          //Set Price
          if(!empty($getPrice1)){
          mysqli_query($connect, "UPDATE specials SET price='$getPrice1' WHERE id=1");
          }
          //Set Include
          if(!empty($getInc1)){
              mysqli_query($connect, "UPDATE specials SET include='$getInc1' WHERE id=1");
          }
          //Set noinclude
          if(!empty($getNoInc)){
              mysqli_query($connect, "UPDATE specials set notinclude='$getNoInc' WHERE id=1");
          }
  
  
      }
  </code></pre>