--- a/displayCalendar.php
+++ b/displayCalendar.php
@@ -1,77 +1,92 @@
-<?php
-include_once("./lib/common.inc.php");
-
-include_header("Months and Years");
-
-if ($_REQUEST['month']) {
-    echo "<center><h1>".$_REQUEST['month']."</h1></center>";
-$monthParts = explode("-",$_REQUEST['month']);
-  $query = "SELECT CNID, description, value, agencyName, category, contractStart, supplierName
-    FROM `contractnotice`
-    WHERE childCN = 0 
-    AND YEAR(contractStart) = {$monthParts[1]}
-    AND MONTH(contractStart)  = {$monthParts[0]}
-    ORDER BY value DESC";
-  $result = mysql_query($query);
-echo '<img src="graphs/displayMethodCountGraph.php?month=' . stripslashes($supplier) . '">';
-   echo '<img src="graphs/displayCnCGraph.php?month=' . stripslashes($supplier) . '">';
-
-  echo "<table>  <thead>
-    <tr>
-      <th>Contract Notice Number</th>
-      <th>Contract Description</th>
-      <th>Total Contract Value</th>
-      <th>Agency</th>
-      <th>Contract Start Date</th>
-      <th>Supplier</th>
-    </tr>
-  </thead>";
-  while ($row = mysql_fetch_array($result, MYSQL_BOTH)) {
-    setlocale(LC_MONETARY, 'en_US');
-    $value = number_format(doubleval($row['value']) , 2);
-    echo ("<tr>
-    <td><a href=\"displayContract.php?CNID={$row['CNID']}\">{$row['CNID']}</a></td>
-    <td><b>{$row['description']}</b></a></td>
-    <td>\$$value</td><td>{$row['agencyName']}</td>
-    <td>{$row['contractStart']}</td>
-    <td>{$row['supplierName']}</td>
-    </tr>");
-  }
-  echo "</table>";
-  mysql_free_result($result);
-} else {
-/*
-     split by year
-todo:
-Year/Month drilldown - largest contracts, agencies, suppliers
-count per month
-big picture graphs?*/
-
-
-echo '<img src="graphs/displayContractStartingGraph.php">';
-echo '<img src="graphs/displayContractPublishedGraph.php">';
-
-
-$query = "SELECT YEAR(contractStart), MONTH(contractStart),
-SUM(value) as val, count(1) as count FROM `contractnotice` WHERE childCN = 0 GROUP BY MONTH(contractStart), YEAR(contractStart) ORDER BY YEAR(contractStart), MONTH(contractStart) ";
-
-$result = mysql_query($query);
-  echo "<table>  <thead>
-    <tr>
-      <th>Month/Year</th>
-      <th>Total Contracts Value</th>
-      <th>Number of Contracts</th>
-    </tr>
-  </thead>";
-while ($row = mysql_fetch_array($result, MYSQL_BOTH)) {
-setlocale(LC_MONETARY, 'en_US');
-$value = number_format(doubleval($row["val"]),2);
-$month_name = date( 'F', mktime(0, 0, 0, $row[1]) );
-    echo ("<tr><td><b><a href=\"?month=$row[1]-$row[0]\">$month_name {$row[0]}</a></b></td><td>\$$value</td><td>({$row['count']} contracts)</td></tr>");
-}
-echo "</table>";
-mysql_free_result($result);
-}
-include_footer();
-?>
+<?php
 
+include_once("./lib/common.inc.php");
+
+
+
+if ($_REQUEST['month']) {
+    $monthParts = explode("-", str_replace(Array("'","/","\\"), "",$_REQUEST['month']));
+    $year = str_replace('-', '',$monthParts[1]);
+    $month = str_replace('-', '',$monthParts[0]);
+    $monthName = date("F Y",  mktime(0,0,0,$month,1,$year));
+            
+    include_header($monthName);
+    echo "<center><h1>" . $monthName . "</h1></center>";
+    
+    $query = 'SELECT "CNID", "description", "value", "agencyName", "category", "contractStart", "supplierName"
+    FROM contractnotice
+    WHERE "childCN" is null
+    AND extract(year from "contractStart") = :year
+    AND extract(month from "contractStart")  = :month
+    ORDER BY value DESC';
+    $query = $conn->prepare($query);
+    $query->bindParam(":month", $monthParts[0]);
+
+    $query->bindParam(":year", $monthParts[1]);
+    $query->execute();
+    databaseError($conn->errorInfo());
+
+    //MethodCountGraph($supplier);
+    //CnCGraph($supplier);
+
+    echo "<table>  <thead>
+    <tr>
+      <th>Contract Notice Number</th>
+      <th>Contract Description</th>
+      <th>Total Contract Value</th>
+      <th>Agency</th>
+      <th>Contract Start Date</th>
+      <th>Supplier</th>
+    </tr>
+  </thead>";
+    foreach ($query->fetchAll() as $row) {
+        setlocale(LC_MONETARY, 'en_US');
+        $value = number_format(doubleval($row['value']), 2);
+        echo ("<tr>
+    <td><a href=\"displayContract.php?CNID={$row['CNID']}\">{$row['CNID']}</a></td>
+    <td><b>{$row['description']}</b></a></td>
+    <td>\$$value</td><td>{$row['agencyName']}</td>
+    <td>{$row['contractStart']}</td>
+    <td>{$row['supplierName']}</td>
+    </tr>");
+    }
+    echo "</table>";
+} else {
+    /*
+      split by year
+      todo:
+      Year/Month drilldown - largest contracts, agencies, suppliers
+      count per month
+      big picture graphs? */
+include_header("Months and Years");
+
+    ContractStartingGraph();
+    ContractPublishedGraph();
+
+
+    $query = 'SELECT extract(year from "contractStart"), extract(month from "contractStart"),
+SUM(value) as val, count(1) as count FROM contractnotice WHERE '.$yearQ.' "childCN" is null GROUP BY extract(year from "contractStart"), extract(month from "contractStart") 
+ORDER BY extract(year from "contractStart") asc, extract(month from "contractStart") asc';
+    $query = $conn->prepare($query);
+    $query->execute();
+    databaseError($conn->errorInfo());
+
+    echo "<table>  <thead>
+    <tr>
+<th>Num</th>
+      <th>Month/Year</th>
+      <th>Total Contracts Value</th>
+      <th>Number of Contracts</th>
+    </tr>
+  </thead>";
+    foreach ($query->fetchAll() as $row) {
+        setlocale(LC_MONETARY, 'en_US');
+        $value = number_format(doubleval($row["val"]), 2);
+        $month_name = date('F', mktime(0, 0, 0, $row[1]));
+        echo ('<tr><td>'.$row[0].'-'.$row[1].'</td><td><b><a href="?month='.$row[1].'-'.$row[0].'">'.$month_name.' '.$row[0].'</a></b></td><td>$'.$value.'</td><td>('                .$row['count'].' contracts)</td></tr>');
+    }
+    echo "</table>";
+}
+include_footer();
+?>
+