with a quick scan it looks like rating.php is the only file that actually takes user data up top simply changing to this:
Code:
$gameid = mysql_real_escape_string($_POST['gameid']);
$gameid2 = mysql_real_escape_string($_POST['gameid']);
$score = mysql_real_escape_string($_POST['score']);
cleans the data before MySQL actually uses it. I'm going to keep looking around for anything outside the admin panel but with a quick look that appears to be the only thing vulnerable.