<h1> <? echo $y->title; ?> </h1>

You forgot htmlspecialchars and now you have XSS. Which is why facebook built XHP originally:

https://www.facebook.com/notes/facebook-engineering/xhp-a-ne...