I strongly urge that you look into using the $_POST and _$REQUEST and $_GET superglobals when reading any values passed back through the GET or POST methods of the browser.... otherwise your script is a massive security vulnerability waiting to be exploited
This was something more heavily emphasized in PHP4, though it is supported in PHP3 IIRC.