The reason you aren't getting any results is that you aren't executing a SQL statement.

When corrected, you may get some results, but you'll also be open to SQL injection.

Jeff's question is perfect. Focus on what you want to get before focusing on how to get it.