FYI, the code generated isn't very good. It will allow a sql-injection attack which can at best reveal all data and at worst be used to compromise your server.
You should specify the SQL code use named parameters or at least mysql_real_escape_string on all data.