Be warned that this code is potentially insecure. A malicious user could tamper with the 'cols' form variable and inject their own SQL into your database call(s).