This is really bad PHP code. I don't want to ask this, but are you not protecting against MySQL injection? (Thats not my only reason)
I admit that the code is badly written. I'd mentioned that it was still in development when ditched. Please check config/connect.php where I'm taking care of magic quotes.