Error inserting binary data into database

Question

I'm getting this error in my php script:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'M Uɽފ ')' at line 1

and my code:

$Connection = mysql_connect("127.0.0.1", "root", "12345678");
mysql_select_db("database5", $Connection);

$Hashsz = "FF381278A9AB19274D9755C9BDDE8A82";
$HashBin = pack("H*", $Hashsz);

$Query = "INSERT INTO Hashes (Hash) VALUES ('{$HashBin}')";
if(mysql_query($Query, $Connection))
{
    echo "inserted";
}
else
{
    echo mysql_error();
}

the value type is: binary(16)

why?

Answer 1

With old mysql extension you should use mysql_real_escape_string to escapes your $HashBin . Even better you shoud use prepared statements and parameterized queries. Read " How can I prevent SQL-injection in PHP? " question.