Xss inection

http://seclists.org/fulldisclosure/2014/Nov/3
$max_date was not washed

Wash $max_date when get from $_GET could be a good idea :)
To prevent these type of breach think about to use a Framework :p