Small bug: I haven't figured out at which point this happens exactly, but the script seems to be over-enthusiastic adding the "Welcome" prefix:

Welcome to $SITENAME$! Welcome to $SITENAME$! Welcome to $SITENAME$! The code you show is vulnerable to SQL injection. Use the proper sanitation method of your library (like mysql_real_escape_string() for the classic mysql library), or switch to PDO and prepared statements.

Unless you already know what causes this, I'll keep an eye on it and report back.

status-completed

Small bug: I haven't figured out at which point this happens exactly, but the script seems to be over-enthusiastic adding the "Welcome" prefix:

Welcome to $SITENAME$! Welcome to $SITENAME$! Welcome to $SITENAME$! The code you show is vulnerable to SQL injection. Use the proper sanitation method of your library (like mysql_real_escape_string() for the classic mysql library), or switch to PDO and prepared statements.

Unless you already know what causes this, I'll keep an eye on it and report back.