"SELECT * FROM table WHERE id = '".mysql_real_escape_string($_GET['id'])."' and name = '".mysql_real_escape_string($_GET['name'])."'";