You might want to post a few judicious snippets of your code enclosed by [ php ] tags (just use the php button in the editor on this site).
That said, it is likely that your variables are showing up in the $GET or $POST Arrays.
Try adding these simple lines at the top of your page that processes the form to see what's coming in:
print "GET Vars:<BR>";
print implode(":",array_keys($GET));
print "<BR>Post Vars:<BR>";
print implode(":",array_keys($POST));
So, what you need is something like
$query = "select * from sometable where somefield ='".$_GET['varname']."''";