Right now there is a mixture of raw mysql_...() commands and commands run through a mysql pseudo-class. these should be replaced with a pdo-based class (and queries redone to use prepared statements).