Untitled

<?php

        $db = mysql_connect("wavemeup.ru", "t1ok", "t1ok") or die('Could not connect: ' . mysql_error());
        mysql_select_db('game') or die('Could not select database');
        function getid($login) {
$res=mysql_query("SELECT * FROM users WHERE login='$login'");
$user=mysql_fetch_assoc($res);
$id=$user["id"];
return $id;
}

        // Strings must be escaped to prevent SQL injection attack.
        $name = mysql_real_escape_string(@$_GET['name'], $db);
        $pass = mysql_real_escape_string(@$_GET['pass'], $db);
        $mail = mysql_real_escape_string(@$_GET['mail'],$db);
        $hash = isset($_GET['hash']);
        $secretKey="r1r2r3r4"; # Change this value to match the value stored in the client javascript below

        $real_hash = md5($name . $pass . $mail . $secretKey);
$res=mysql_query( "SELECT * FROM users WHERE login='$name'");
if (@mysql_num_rows($res)!=0) {

} else {

        if($real_hash == $hash) {
$rlogin = md5($pass);
            $query="INSERT INTO users (email,login,pass) VALUES ('$mail','$name','$rlogin');";
            $result = mysql_query($query) or die('Query failed: ' . mysql_error());

$a=getid($name);
echo $a;
mysql_query("INSERT INTO events (type,user_id,text,when) VALUES ('reg','$a','<strong>$name</strong> присоединился к нам!', now())");
            // Send variables for the MySQL database class.
mysql_query("INSERT INTO profile (img) VALUES ('/profile/userpic.jpg')");
        }
}
?>