Code was quite long to anyone debug for your behalf.

GENERAL HINT #1:

var_dump($_REQUEST);
do that sometimes to check if post&get-variables are received in a way you 
thought they are.

GENERAL HINT #2;

concanate sql query parts into one string and print that instead of 
excetuting. copy then it from the screen and use phpmyadmin to check what 
query really returns or is it valid syntax at all.