Originally Posted by BoyAlley

NEVER trust input into a php script like that.

Simply using <?=$_GET["id"]?> alone is NOT a safe way to do this!

You're setting yourself to get the living hell hacked out of you.

The variable MUST have something in place to parse out the crap from the input before echoing out a variable like that.