On submit from textarea - mysql error

Answer 1

you need to use

 mysql_escape_string

To clean your POST variable for use in the MySQL Query

Answer 2

You can clean up text that you are inserting into the database with the mysql_real_escape_string() function. This adds backslashes in front of the characters that can cause problems, such as the single quote.

$sql="UPDATE works SET client='".mysql_real_escape_string($_POST["client"])."', description='".mysql_real_escape_string($_POST["description"])."', text='".mysql_real_escape_string($_POST["text"])."', image='".mysql_real_escape_string($_FILES["attels"]["name"])."' WHERE id=".sprintf("%d", $_GET['id'])."";

Ideally you should also use sprintf() to guard against SQL injection.