Just a side note:

htmlspecialchars() is your friend. You might want to escape/sanitize your input ($_GET and such).