Script fout

Beste one2xsers

Ik heb dus volgende code voor mijn klikfans op klikspel.eu

[COLOR= #0000BB]<?php

$id[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_GET[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]id[/COLOR][COLOR= #007700]];[/COLOR]
[COLOR= #0000BB]$query[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #DD0000]"SELECT * FROM klikfans WHERE id = $id and game=$game"[/COLOR][COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$result[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$query[/COLOR][COLOR= #007700])[/COLOR] or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR]
[URL="http://www.php.net/while"]while[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$object[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_fetch_object"]mysql_fetch_object[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$result[/COLOR][COLOR= #007700])){[/COLOR]
[COLOR= #0000BB]$actief[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$object[/COLOR][COLOR= #007700]->[/COLOR]actief[COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$url[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$object[/COLOR][COLOR= #007700]->[/COLOR]url[COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$nu[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$object[/COLOR][COLOR= #007700]->[/COLOR]nu[COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$opbrengst[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]1[/COLOR][COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$maximaal[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$object[/COLOR][COLOR= #007700]->[/COLOR]maximaal[COLOR= #007700];
}[/COLOR]
    [URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$actief[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #DD0000]"1"[/COLOR][COLOR= #007700]){[/COLOR] [COLOR= #FF8000]//actiefcontrole[/COLOR]
        [URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$nu[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]$maximaal[/COLOR][COLOR= #007700]){[/COLOR] [COLOR= #FF8000]//maximaalcontrole[/COLOR]
        [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"UPDATE `klikfans` SET actief=0 WHERE `id` = $id"[/COLOR][COLOR= #007700]);
        }[/COLOR]
            [COLOR= #0000BB]$date[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/date"]date[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"Ymd"[/COLOR][COLOR= #007700]);[/COLOR]
            [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"INSERT INTO kfkliks (user, banner, date, game) VALUES ($guser, $id, $date, $game)"[/COLOR][COLOR= #007700])[/COLOR] or [URL="http://www.php.net/print"]print[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR]
            [COLOR= #0000BB]$result2[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"SELECT * FROM kfkliks WHERE user = "[/COLOR][COLOR= #007700].[/COLOR][COLOR= #0000BB]$guser[/COLOR][COLOR= #007700].[/COLOR][COLOR= #DD0000]" AND id = $id AND date = $date and game = $game"[/COLOR][COLOR= #007700]);[/COLOR]
                [URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_num_rows"]mysql_num_rows[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$result2[/COLOR][COLOR= #007700]) ==[/COLOR] [COLOR= #0000BB]1[/COLOR][COLOR= #007700]){[/COLOR]
                [COLOR= #FF8000]//als alles klopt[/COLOR]
                [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"UPDATE `klikfans` SET nu=nu+1 WHERE `id` = $id"[/COLOR][COLOR= #007700]);[/COLOR]
                [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"UPDATE `deal_leden` SET saldo=saldo+$opbrengst WHERE `user` = $guser and `game` = $game"[/COLOR][COLOR= #007700]);[/COLOR]
                [URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"Je punten zijn bijgeschreven, je wordt nu doorgestuurd!"[/COLOR][COLOR= #007700];[/COLOR]
                [URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"<meta http-equiv="refresh" content="0;URL=$url">"[/COLOR][COLOR= #007700];
                }[/COLOR][URL="http://www.php.net/else"]else[/URL][COLOR= #007700]{[/COLOR]
                [URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"Je hebt vandaag al geklikt!"[/COLOR][COLOR= #007700];
                }
    }[/COLOR][URL="http://www.php.net/else"]else[/URL][COLOR= #007700]{[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"Deze klikfan is niet actief!"[/COLOR][COLOR= #007700];
}[/COLOR]
?>

Maar ik krijg heel de tijd " Deze klikfan is niet actief! "
wanneer ze wel actief is, nog genoeg kliks over heeft en in de juist game staat.

Wat doe ik mis
En hoe beveilig ik dit op mysql injecties en dergelijke?

mvg
Wouter

MySQL injectie beveiling: mysql_real_escape_string($string)

@Erik: en wat moet ik dan beveiligen?