[akanevsky]

Of course it does. This is really improper use of MySQL... And I really think that before writing your applications, you should read the tutorial and security tips.

However, I appreciate you trying to be creative, so there you go:
1. In MySQL queries, always enclose values into single quotes ('). That is how the script knows, where the string starts and where it ends.
2. In MySQL queries, when there is user input that cannot be validated, always use addslashes function.

Therefore, the correct query would be:

$DB_site->query("

UPDATE " . TABLE_PREFIX . "attachment

SET postid = $post[postid], posthash = '', caption = '" . addslashes($attach[caption]) . "'

WHERE posthash = '" . addslashes($post['posthash']) . "'

AND userid = $bbuserinfo[userid]

");

Note: I used double quotes (") to escape from the string and to be able to use the addslashes function Good luck with the rest.