It appears that you are opening your app to a sql injection attack.
A single quote in any of the fields would result in the above error.
essentially turning your sql to something like this:
select * from cottages, pricebands where location = 'D'angelo st'
......
(i.e. unescaped single quote).
Use bind variables .. for performance .. and security!
