escape hell

gw-insert.php

@@ -20,7 +20,7 @@ if ($droptype == 1){
 } else if ($droptype == 2){
 	$runeid = mysqli_real_escape_string($con, $_POST['runeid']);
 	$runerare = mysqli_real_escape_string($con, $_POST['runerarity']);
-	echo "SQL code should be \"INSERT INTO `history` (historydate, charnameid, locationid, goldrec, itemtype, itemrarity, runetype) VALUES ('$treasdate', $toonid, $locid, $gold, '16', $runerare, $runeid\" <BR />";
+	echo "SQL code should be \"INSERT INTO `history` (historydate, charnameid, locationid, goldrec, itemtype, itemrarity, runetype) VALUES (\'$treasdate\', $toonid, $locid, $gold, \'16\', $runerare, $runeid)\" <BR />";
 	echo 'drop was a rare material!<BR />';
 } else if ($droptype == 3){
 	echo 'drop was a rune!<BR />';