Might want to call `mysql_real_escape_string` on `$_USER['uid']` here and below on line 23. It probably won't be an issue, but we should be consistent and play it safe.