Yes, you wouldn't be able to use parameters to pass the value because of SQL injection prevention code that is automatically applied as Dave suggests. The solution is to add the code to your SQL statement directly as you have discovered. However this opens your query to SQL injection particularly when using a $_GET variable, so be very careful using this technique and make sure you have other protection on the page such as a login required to prevent abuse.
Did this help? Tips are appreciated...
