This is not a bug in PHP, but a bug in the script...
The query that you're forming inside the double quotes
simply isn't a valid SQL query.
The reason it works with variables that come from forms,
is that you probably have magic_quotes_gpc turned on,
and magic_quotes_gpc automatically escapes any input
coming from GET/POST/Cookie variables, so no further
escaping is required.

To avoid the problem, you should run addslashes() on
the string before putting it into the query text, e.g.
$foo = addslashes($foo);