Yeah you're right - thats what I realized about 5 minutes ago (when printing out the actual string that was being passed to mySQL)

Thanks for the pointer though :)