The code you posted is not secure. You really should be sanitizing anything that comes through `$_POST`. It's probably also not safe against XSRF attacks, though I'm not too familiar with that subject.
I see a lot of `mysql_query()` in your code; it's probably better to compile one long query in your code and then, at the end, actually query the database. (I don't really have experience with databases, but I'm speaking from a coding standpoint.)
Comments
The code you posted is not secure. You really should be sanitizing anything that comes through `$_POST`. It's probably also not safe against XSRF attacks, though I'm not too familiar with that subject.
I see a lot of `mysql_query()` in your code; it's probably better to compile one long query in your code and then, at the end, actually query the database. (I don't really have experience with databases, but I'm speaking from a coding standpoint.)