I should probably check the variable using mysql_real_escape_string().