Listbox Not Filtering

[WestWing]

I have an HTML Select List that has the ABC's in it. When I select one of the alphabet letters this in turn returns only the records starting with that letter. The HTML part works fine. The Javascript part seems to be getting the value, I see the correct value when I put an alert on it. The MySQL query works fine in PHP admin. But for someon reason when its put all together I get nothing. Here is what I have so far.

The HTML Select.

<form name="Alphabets" method="post" action="">
<select name="Alpha" id="Alpha" class="slideSelect1">
<option value="" data-image-src="../Images/Buttons/A.png">SS</option>
<option value="A" data-image-src="../Images/Buttons/A.png">A</option>
<option value="B" data-image-src="../Images/Buttons/B.png">B</option>
</select>
<input type="hidden" input name="Letter" id="Letter">
</form>

The JavaScript.

$(document).ready(function()
{
$("#Alpha").change(function()
{
var Letter = $(this).val();
$.ajax({
type: "POST",
url: "alpha_search.php",
data: {"Letter":Letter},
cache: false,
success: function (html) {
//alert (Letter);
$("#RestMenus").html(html);
}
});
});
});

The PHP....

<?php
require('config.php');


$Letter=$_POST['Letter'];

$sql=mysql_query("SELECT tblLocations.LocationID as Lid, tblRestaurants.RestName, tblLocations.MenuPage
				FROM
				tblRestaurants
				INNER JOIN tblLocations ON tblRestaurants.RestID = tblLocations.RestID
				WHERE tblRestaurants.RestName LIKE 'Letter%'
				ORDER BY tblRestaurants.RestName ASC");

			echo '<option selected="selected">--Select Restaurant--</option>';
			while($row=mysql_fetch_array($sql))
			{
			echo '<option value="'.$row['Lid'].'">'.$row['RestName'].'</option>';
			}
?>

Help is appreciated. Thank you.

[WestWing]

I did some changes to the form. I thought that would help. It didn't.

<form  method="post" action="alpha_search.php">
<select name="Alpha" id="Alpha" class="slideSelect1">
<option value="" data-image-src="../Images/Buttons/A.png">SS</option>
<option value="A" data-image-src="../Images/Buttons/A.png">A</option>
<option value="B" data-image-src="../Images/Buttons/B.png">B</option>
</select>
</form>

[Weedpacket]

"SELECT tblLocations.LocationID as Lid, tblRestaurants.RestName, tblLocations.MenuPage
				FROM
				tblRestaurants
				INNER JOIN tblLocations ON tblRestaurants.RestID = tblLocations.RestID
				WHERE tblRestaurants.RestName LIKE 'Letter%'
				ORDER BY tblRestaurants.RestName ASC"

Because regardless of what you're posting, you ignore it and instead only select restaurants with names that literally start with "Letter".

Either properly escape your posted value and embed it in the query, or use a more modern MySQL interface and bind it.

[WestWing]

Makes sense. So how do I properly escape the posted value and embed it in the query. Like the forum says, I'm so at this point I don't know how. Thank you.

[WestWing]

Did this on the PHP page and it works. Thank you!

$Letter=$POST['Letter']= mysql_real_escape_string($POST['Letter']);;