Re: unexpected T_LNUMBER?
You need to escape the quotes in your string. There are however more important things you should be worrying about as your script has several security issues. I would strongly advise you do not publish it on the Internet until you have resolved these:
- You are using register_globals (it makes variables from forms, the url and cookies global variables). First, do not use it as it is deprecated, second it is very easy to fall into the trap of writing code which can be exploited when it is on. Go to your php.ini and change the line register_globals=on to off.
An attacker to use this to poison the data in your script if you leave it on.
- Second you are not escaping variables which are to go into SQL queries. If you do not do this an attacker could inject SQL into those variables and reveal data from other tables or execute code on the server. Have a look at the mysql_escape_string function and ensure that any data from an external source passes through this function before it goes into an SQL query.
Re: unexpected T_LNUMBER?
Also, look at using PDO (PHP 5) or MDB2 (PHP 4) or at the very least mysqli, all of which provide support for parameterised commands, which are vastly superior to escaping data.