wrote query.php. still needs form validation