dangerous mysql query

I have error report in url http://localhost/ns/any_word' (with single quote at end).

user warning: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''any_word''' at line 1 query: SELECT count(*) AS total FROM counter WHERE counter_ip='127.0.0.1' AND counter_date='2008-12-12' AND counter_page='any_word'' in C:\WWW\PUB\ns\modules\counter\counter.module on line 239.

in file 'counter.module' at line 236:

		$sql = " SELECT count(*) AS total FROM {counter}"
		      ." WHERE counter_ip='$counter_ip' AND counter_date='$counter_date' AND counter_page='$counter_page'";
              
		$results = db_query($sql);

and at line 244:

		  $sql = " INSERT IGNORE INTO {counter}  "
                ." (counter_ip, counter_date, counter_page) VALUES "
                ." ('$counter_ip', '$counter_date', '$counter_page') ";
              
		  $results = db_query($sql);	

========================================
patch for 1:

		$sql = " SELECT count(*) AS total FROM {counter}"
		      ." WHERE counter_ip='%s' AND counter_date='%s' AND counter_page='%s'";
              
		$results = db_query($sql,$counter_i,$counter_date,$counter_page);

patch for 2:

		  $sql = " INSERT IGNORE INTO {counter}  "
                ." (counter_ip, counter_date, counter_page) VALUES "
                ." ('%s', '%s', '%s') ";
              
		  $results = db_query($sql,$counter_ip,$counter_date,$counter_page);