Send Points

<?php
session_start();
include "config.php";
if($logged[username])
{
switch($_GET[page])
{
default:
echo ("
You have <b>$logged[points]</b> points in hand to send.<br>
<form method='post' action='?page=send'>
<select name='username'>");
$fetch = mysql_query("SELECT * FROM `members`");
while ($user = mysql_fetch_array($fetch))
{
echo ("<option value='$user[username]'>$user[username]</option>");
}
echo ("
</select><br>
<input type='text' name='points' size='20'>
<input type='submit' name='submit' value='Send'>");
break;
 
case 'send':
$username = strip_tags(htmlspecialchars($_POST[username]));
$points = strip_tags(htmlspecialchars($_POST[points]));
if ($logged[points] < $points)
{
echo ("You don't have that many points. <a href='send_points.php'>Back</a>");
}
elseif ($points == NULL)
{
echo ("Please enter a value of points. <a href='send_points.php'>Back</a>");
}
else
{
$fetch = mysql_query("SELECT * FROM `members` WHERE `username` = '$username'");
$user = mysql_fetch_array($fetch);
 
$points1 = $logged[points]-$points;
$points2 = $user[points]+$points;
 
$update1 = mysql_query("UPDATE `members` SET `points` = '$points1' WHERE `username` = '$logged[username]'");
$update2 = mysql_query("UPDATE `members` SET `points` = '$points2' WHERE `username` = '$username'");
echo ("You have sent $points to $username. <a href='send_points.php'>Back</a>");
}
break;
}
}
?>

$fetch = mysql_query("SELECT * FROM `members`");
while ($user = mysql_fetch_array($fetch))
{
echo ("<option value='$user[username]'>$user[username]</option>");
}

<form method='post' action='?page=send'>
<select name='username'>");
$fetch = mysql_query("SELECT * FROM `members`");
while ($user = mysql_fetch_array($fetch))
{
echo ("<option value='$user[username]'>$user[username]</option>");
}
echo ("
</select><br>
<input type='text' name='points' size='20'>
<input type='submit' name='submit' value='Send'>");

if ($logged[points] < $points)
{
echo ("You don't have that many points. <a href='send_points.php'>Back</a>");
}

$points1 = $logged[points]-$points;
$points2 = $user[points]+$points;
 
$update1 = mysql_query("UPDATE `members` SET `points` = '$points1' WHERE `username` = '$logged[username]'");
$update2 = mysql_query("UPDATE `members` SET `points` = '$points2' WHERE `username` = '$username'");
echo ("You have sent $points to $username. <a href='send_points.php'>Back</a>");