Problem with parameters appending to file ...

[clubbedougan]

My page new_items.php displays all the contents from the 'items' table of my database, however I want to display solely the data where type equals 1 when the url is new_items.php?type=1
My current code :

$query2 = "SELECT i.id, i.name, i.types, i.descr, i.thumb, i.price, t.id, t.type, p.id, p.name FROM gitems as i, publishers as p, types as t WHERE i.publisher = p.id AND i.types = t.id AND DATE_SUB(CURDATE(),INTERVAL 30 DAY) AND t.type LIKE ('$type') ORDER BY i.id DESC LIMIT $start, $display";

<?
require_once ('../connect2db.php');

// Number of records to show per page:
$display = 8;

$type = (isset($_GET['type'])) ? $_GET['type'] : "%";

$genre = (isset($_GET['genre'])) ? $_GET['genre'] : "%";

// Determine how many pages there are. 
if (isset($_GET['np'])) { // Already been determined.

$num_pages = $_GET['np'];

} else { // Need to determine.

$from = "";
$where = "WHERE ";

    $from.= ", types as t";
	$where.= "i.types = t.id AND t.type = '$type' AND DATE_SUB(CURDATE(),INTERVAL 30 DAY)";

$where = ($where == "WHERE ") ? "" : $where;

// Count the number of records
$query = "SELECT COUNT(i.id) FROM gitems as i $from $where ORDER BY i.id ASC";
$result = mysql_query ($query);
$row = mysql_fetch_array ($result, MYSQL_NUM);
$num_records = $row[0];

// Calculate the number of pages.
if ($num_records > $display) { // More than 1 page.
	$num_pages = ceil ($num_records/$display);
} else {
	$num_pages = 1;
}

} // End of np IF.

// Determine where in the database to start returning results.
if (isset($_GET['s'])) {
	$start = $_GET['s'];
} else {
	$start = 0;
}

?>

Any ideas ?

Thankyou,,

[sneakyimp]

if you don't screen the user input before running queries, then you run the risk of someone doing SQL injection and reading your secret data - if you have any.

looks to me like you should change this line:

$where.= "i.types = t.id AND t.type = '$type' AND DATE_SUB(CURDATE(),INTERVAL 30 DAY)"; 

maybe try this:

$where.= "i.types = t.id AND t.type LIKE '$type' AND DATE_SUB(CURDATE(),INTERVAL 30 DAY)";