yup the sql statement forgot to escape some stuff

gw-insert.php

@@ -12,7 +12,7 @@ if ($droptype == 1){
 	$attrib = mysqli_real_escape_string($con, $_POST['attribute']);
 	$weap = mysqli_real_escape_string($con, $_POST['weapon']);
 	$itname = mysqli_real_escape_string($con, $_POST['itemname']);
-	echo 'SQL code to run: "INSERT INTO `history` (historydate, charnameid, locationid, goldrec, itemreq, itemtype, itemattribute, itemrarity, itemname) VALUES	(\'$variable-date-of-treasure\', ' . $toonid . ', ' . $locid . ', ' . $gold . ', ' . $req . ', ' . $weap . ', '$variable-attribute-of-weapon', '$variable-rarity-of-weapon', '$variable-name-of-weapon');"<BR />';
+	echo "SQL code to run: \"INSERT INTO `history` (historydate, charnameid, locationid, goldrec, itemreq, itemtype, itemattribute, itemrarity, itemname) VALUES ('variable-date-of-treasure', $toonid, $locid, $gold, $req, $weap , 'variable-attribute-of-weapon', 'variable-rarity-of-weapon', 'variable-name-of-weapon');\"<BR />";
 	//echo '<BR />Well something broke somewhere!<BR />';
 } else if ($droptype == 2){
 	echo 'drop was a rare material!<BR />';