That's another problem - I'll help you for free because I'm nice and this is HN, but if I'm to consider money as a motivator, $5 (or a tip which must be assumed to be less) is downright offensive.

The problem is this PHP:

<?php echo @file_get_contents($_GET['url']);?>

It does nothing to validate the request, and will trivially proxy any request to not just any webpage in the world, but any file readable to your webserver.

What you want is something like:

  <?php 
  $zip = $_GET['zip'];
  if (preg_match("/^(^\d{5}$)|(^\d{5}-\d{4}$)$/", $zip)) {
    echo @file_get_contents("http://www.webservicex.net/uszip.asmx/GetInfoByZIP?USZip=".$zip);
  }
  ?>

Not tested, but that's the general idea.