Bad use of colname?? HELP

[ocbphoto]

I am not sure what i am doing wrong, can someone help me please.

I have my DB which contains

- Manufacturer Table
- Model Table (this one contains also the year field)

I want to be able to choose Manufacturer>Model>Year will be display in the text area but nothing changes!

Thank you

<?php require_once('Connections/XXXX.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

mysql_select_db($database_Web_dbP321, $Web_dbP321);
$query_fxmanu = "SELECT * FROM manufacturer ORDER BY manufacturer_name ASC";
$fxmanu = mysql_query($query_fxmanu, $Web_dbP321) or die(mysql_error());
$row_fxmanu = mysql_fetch_assoc($fxmanu);
$totalRows_fxmanu = mysql_num_rows($fxmanu);

$colname_fxmodel = "1";
if (isset($_POST['manu'])) {
  $colname_fxmodel = $_POST['manu'];
}
mysql_select_db($database_Web_dbP321, $Web_dbP321);
$query_fxmodel = sprintf("SELECT * FROM model WHERE manufacturer_id = %s ", GetSQLValueString($colname_fxmodel, "int"));
$fxmodel = mysql_query($query_fxmodel, $Web_dbP321) or die(mysql_error());
$row_fxmodel = mysql_fetch_assoc($fxmodel);
$totalRows_fxmodel = mysql_num_rows($fxmodel);

$colname_fxyear = "-1";
if (isset($_POST['model'])) {
  $colname_fxyear = $_POST['model'];
}
$colname1_fxyear = "-1";
if (isset($_POST['manu'])) {
  $colname1_fxyear = $_POST['manu'];
}
mysql_select_db($database_Web_dbP321, $Web_dbP321);
$query_fxyear = sprintf("SELECT * FROM model WHERE manufacturer_id = %s AND manufacturer_id = %s ", GetSQLValueString($colname_fxyear, "int"),GetSQLValueString($colname1_fxyear, "int"));
$fxyear = mysql_query($query_fxyear, $Web_dbP321) or die(mysql_error());
$row_fxyear = mysql_fetch_assoc($fxyear);
$totalRows_fxyear = mysql_num_rows($fxyear);
?><table width="402" border="1">
  <tr>
    <td width="392" height="125"><form id="form1" name="form1" method="POST" action="<?php echo $editFormAction; ?>">
      <label>
      <select onchange="document.form1.submit()" name="manu" id="manu">
        <?php
do {  
?>
        <option value="<?php echo $row_fxmanu['manufacturer_id']?>"<?php if (!(strcmp($row_fxmanu['manufacturer_id'], @$_POST['manu']))) {echo "selected=\"selected\"";} ?>><?php echo $row_fxmanu['manufacturer_name']?></option>
<?php
} while ($row_fxmanu = mysql_fetch_assoc($fxmanu));
  $rows = mysql_num_rows($fxmanu);
  if($rows > 0) {
      mysql_data_seek($fxmanu, 0);
	  $row_fxmanu = mysql_fetch_assoc($fxmanu);
  }
?>
      </select>
      </label>
        <label>
        <select onchange="document.form1.submit()" name="model" id="model">
          <?php
do {  
?>
          <option value="<?php echo $row_fxmodel['manufacturer_id']?>"<?php if (!(strcmp($row_fxmodel['manufacturer_id'], @$_POST['model']))) {echo "";} ?>><?php echo $row_fxmodel['model_name']?></option>
          <?php
} while ($row_fxmodel = mysql_fetch_assoc($fxmodel));
  $rows = mysql_num_rows($fxmodel);
  if($rows > 0) {
      mysql_data_seek($fxmodel, 0);
	  $row_fxmodel = mysql_fetch_assoc($fxmodel);
  }
?>
        </select>
        </label>
        <label></label>
        <label>
        <textarea name="text" id="text" cols="45" rows="5"><?php echo $row_fxyear['year']; ?></textarea>
        </label>
    </form>    </td>
  </tr>
</table>
<?php
mysql_free_result($fxmanu);

mysql_free_result($fxmodel);

mysql_free_result($fxyear);
?>

[pritaeas]

The problem exists because year is also a function. To make sure it uses your column name use backticks, so in the query it looks like this:

`year`