I'm pretty sure it's following part of the WHERE
clause
staff.staffID = '%$staffidstr%'
That should be most likely
staff.staffID = '$staffidstr'
The %
character has no special meaning using the =
operator, so your query will return not a single row.