title: Instert html/text to mysql
body: <p>I am using TinyMCE to allow users to edit the content of certain pages, the problem is that I should store html tags, along with class="" -es and ..etc.
  How should I defend the application against SQL injection, and store the html tags? (main problem is the " -s, It is messing up the mysql query)</p>
  
  <p>In nutshell, I don't know how to add the $_POST (which is a text) to the insert_to_content() function.</p>
  
  <pre><code>    $html = "";
      $url = "";if (isset($_GET["page"])) {$url = safesql($_GET["page"]);}
      $sqlSelectPageText = mysql_query('SELECT * FROM content WHERE name="'.$url.'" LIMIT 1');
      $pageText = mysql_fetch_array($sqlSelectPageText); /**/ $sqlSelectPageText = ""; 
      if (isset($_GET["edit"]) and isset($_POST["text"])) {
          insert_to_content($url,I_SHOULD_DO_SOMTHG_WAAA($_POST["text"]));
          header('Location: admin.php?page='.$url);
      }
  
      $html .= '&lt;div id="editor1div"&gt;';
      $html .= '&lt;form action="admin.php?page='.$url.'&amp;edit" method="post"&gt;';
      $html .= '  &lt;input class="formsSubmit" type="image" src="images/yep2.png" alt="Save" /&gt;';
      $html .= '&lt;p&gt;Content:&lt;/p&gt;';
      $html .= '  &lt;textarea id="editor1" name="text"&gt;';
              $html .= '      '.$pageText["text"]; /**/$pageText = ""; 
      $html .= '  &lt;/textarea&gt;';
      $html .= '&lt;/form&gt;';
      $html .= '&lt;/div&gt;';
  
  
      echo $html;
  
  function insert_to_content($whatPage, $text) {
      if (mysql_query('UPDATE content SET text="'.$text.'", lastdate=NOW() WHERE name="'.$whatPage.'"')) {
          return true;
      } else {
          return false;   
      }
  }
  
  function I_SHOULD_DO_SOMTHG_WAAA($text) {
             //what should i do with it?
  }
  </code></pre>
  
  <p>EDIT:<br />
  @CaNNaDaRk:
  I am trying to use your work, but never used PDO (or OOP PHP) so.<br /> So, is it possible that I don't have this function? :D<br /> "Class 'PDO' not found in.."<br /> `</p>
  
  <pre><code>$db = new PDO("mysql:host=$sqlHost;dbname=$sqlDb;$sqlUser,$sqlPass"); 
  $stmt = $db-&gt;prepare('UPDATE content SET text=:text, lastdate=NOW() WHERE name=:name');
  $stmt-&gt;execute( array(':text' =&gt; $html, ':name' =&gt; $whatPage ) );
  </code></pre>