variables - Php script, query ran from value thats passed in -

i pretty new @ php, quick note android application calling script, not having users make script lol. there series of checkboxs , when check off ones appends script string builder. trying run query based on value of variable being passed in. this,

   mssql_query("update userdata set browsescript = '".$_request['sqlscript']."'  userdata.username = '".$_request['username']."'"); 

and says .$_request[''] can grab values pass in.

but time .$_request[''] whole script, want this

mssql_query($_request['sqlscript']); 

and thats want run query thats in value, query correct, not return value, think may have type of syntax error or something, said new php. help. not posting whole code because running ok, cant query run. need assistance mssql_query part again.

first of there huge security flaw in doing. should sanitalize , escape variables use in queries example using mysql_real_escape_string or prepared statements.

since importing whole script query, quotes not escaped. need put these functions before variables:

mysql_real_escape_string($_request['your_var']); 

using $_request in instead of proper $_get or $_post vulnerable.