php - mySQL insert syntax error with quote -

i'm receive following error below, believe in part quote have in insert string 5'10 - (178cm) in passed $en['height'] variable. what's best way handle error?

error: have error in sql syntax; check manual corresponds mysql server version right syntax use near '10 - (178cm)', m_btype = 'rather not say' @ line 12

this mysql insert:

m_height = '".$en['height']."', 

table set as:

varchar(30) latin1_swedish_ci 

your issue must "escape" strings before inputting them sql queries. not doing allow people alter query inputting quotes. example if input following string:

'; select * users; -- 

its possible execute sql did not intend. solution escape:

m_height = '".mysql_real_escape_string($en['height'])."', 

or better yet use more date method of querying mysql such pdo or mysqli functions.

edit think have more general syntax error. try this:

m_height = "'".mysql_real_escape_string($en['height'])."'",