$res=mysql_query("SELECT * FROM users WHERE user_id=".$_SESSION['user']);
$userRow=mysql_fetch_array($res);
if(isset($_POST['btn_msg'])) {
$msg=htmlspecialchars($_POST['text_msg']);
$to_name=htmlspecialchars($_POST['to_name']);
$to_idq=mysql_query("SELECT user_id FROM users WHERE username='$to_name'");
$to_id=mysql_fetch_array($to_idq);
mysql_query("INSERT INTO message(id1,id2,name1,name2,message) VALUES ('".$userRow['user_id']."','$to_id','".$userRow['username']."','$to_name','$msg')");
}