Mysql Variable issue

Question

I am passing a what will soon be my search variable into php from flash. The issue is when I need to search for something that needs to find a string value in quotes it fails.
Below is the like field variable declared in flash
LikeField = "Model_Profile.Gender = \'m\' ";
This is how I am capturing my like field in php.
$LikeField=mysql_real_escape_string($_POST['likefield']);
Below is my query
"SELECT count(*) AS Total FROM Model_Profile, Models  WHERE  Model_Profile.Model_ID = Models.Model_ID AND Models.Active = 1 AND {$LikeField}"
For some reason it just doesn't seem to like the single quotes on the m, but I need them there to execute. Tracing the flash variables passed it outputs this likefield=Model%5FProfile%2EGender%20%3D%20%27m%27
If I put the query in below it works fine, so I know it's not an issue with my query, misspelling etc.
"SELECT count(*) AS Total FROM Model_Profile, Models  WHERE  Model_Profile.Model_ID = Models.Model_ID AND Models.Active = 1 AND Model_Profile.Gender = 'm' "
If pass this value from flash I get a result
LikeField = "Model_Profile.Active = 1 ";
I am stump and don't know where the issue is at the moment.

Answer 1

It's difficult to give detailed advice without knowing exactly what's going on with this app and how it's going to be implemented.  Personally I like to use stored procedures with MySQL, it helps avoid SQL Injection attacks and it also eliminates the need to deal with quote literals when building a SQL string on the fly.
From the details you did post, it appears that your query alows the user to include or exclude the Gender feature.  How does it handle a situation in which the Gender is not set, so it's not equal to 'm' or 'f'?  Does it simply exclude that field from the WHERE clause?
One of the biggest limitations of MySQL stored procedures is that they don't allow for default values for their parameters.  But you can program around this in the PHP call by including a default value in your PHP code that would be overridden by input from the user in the search form.
If I were going to develop this search, I'd try to limit what I'm passing from Flash to PHP as much as possible.  I'd start with my stored procedure:
DELIMITER $$
DROP PROCEDURE IF EXISTS `db_name`.`sp_name` $$
CREATE DEFINER=`root`@`%` PROCDEURE `sp_name`(prmGender varchar(1))
BEGIN
     SELECT COUNT(*) AS Total FROM Model_Profile, Models  WHERE  Model_Profile.Model_ID = Models.Model_ID AND
Models.Active = 1 AND Model_Profile.Gender LIKE prmGender;
END $$
DELIMITER ;
In my PHP code that calls this stored procedure I'd create a variable for the gender selection and set it to '%' (the MySQL wildcard character) and override it if a specific gender was selected by the user.
This set up allows you to ignore the whole issue of dealing with quotation marks - simply pass the appropriate letter from Flash and pass it into the gender variable in PHP, which you would assign to the stored procedure call.  I hope this is somewhat helpful, if not please provide a bit more detail on your efforts and perhaps I can provide a better option.  Good luck!