You're string-concatenating $_GET['name'] into a query and calling it a builder, which is like calling a woodchipper a salad shooter. That's not a WHERE clause, that's a welcome mat with your database password written on it.