Consider classifying properties

Uh, SQL injection. Please either use the proper methods (like `addQuotes`) or cast the variables (why are they declared as `string`?) to int, e.g. using `intval`.