Do you pass though category
in the request? You haven't given us that information (what is the value of qstr
in the javascript?), but I'd guess not.
You're also passing it straight into an SQL query, which leaves you open to injection.
You should use mysql_escape_string()
to fix that.
Greg
2009-06-11 11:25:24