Friends system

CREATE TABLE `friend_requests` (
`id` int(10) NOT NULL auto_increment,
`username` varchar(225) NOT NULL default '',
`by` varchar(225) NOT NULL default '',
PRIMARY KEY (`id`)
) ENGINE=MyISAM;
 
CREATE TABLE `friends` (
`id` int(10) NOT NULL auto_increment,
`friendname` varchar(225) NOT NULL default '',
`username` varchar(225) NOT NULL default '',
PRIMARY KEY (`id`)
) ENGINE=MyISAM;

<?
session_start(); //starts session
include "config.php"; //include config
 
if ($logged[username]){ //checks user is logged in
 
if ($_GET[user]){ //gets username
$username = htmlspecialchars($_GET[user]); //friend
$by = $logged[username]; //you
$query = mysql_query("INSERT INTO `friend_requests` ( `username` , `by` ) VALUES ( '$username' , '$by' )"); //inserts the request
echo ( "$username has been sent a request you must now wait for it to be accepted" ); //echos completion
} else {
echo ( "No request was made" ); // or no request sent
}
} else {
echo ( "You need to be logged in" ); //not logged in
}
?>

<?
session_start(); // starts sessions
include "config.php"; // inlcudes config
 
if ($logged[username]) { //checks user is logged in
switch ($_GET[friends]) { //allows multiple pages
default:
$get = mysql_query( "SELECT * FROM `friend_requests` WHERE `username` = '$logged[username]' "); //gets requests
while ($reqs = mysql_fetch_array($get))
{
 
echo ( "Friend Requests
$reqs[by] wants to be friends with you.
<a href='newfriends.php?friends=accept&user=$reqs[by]'>Accept</a><br/>
<a href='newfriends.php?friends=delete&user=$reqs[by]'>Delete</a>" ); //displays requests and shows accept delete links
}
break;
 
case 'accept': //accept page
if ($_GET[user]) { //get username
 
$add = mysql_query( "INSERT INTO `friends` (`friendname` , `username`) VALUES ('$_GET[user]' , '$logged[username]') "); // add to your friends list
$delete = mysql_query( "DELETE FROM `friend_requests` WHERE `by` = '$_GET[user]' "); // deletes friend request
echo ( "$_GET[user] has been added as a friend and the request has been deleted" ); // echos the completion
}
break; //ends accept page
 
case 'delete': // delete page
if ($_GET[user]) { //gets username
$delete = mysql_query( "DELETE FROM `friend_requests` WHERE `by` = '$_GET[user]' "); // deletes friend request
echo ( "$_GET[user]'s request has been deleted" ); // echos completion
}
break; //ends delete page
} // ends switch
} else {
echo ( "You need to be logged in" ); // not logged in
}
?>

echo "<fieldset style='width: 350'>
<b>$user[username]'s Profile</b><br><br>
Email: $user[email]<br>
Location: $user[location]<br>
Sex: $user[sex]<br>
Age: $user[age]

 
<a href='friendrequest.php?user=$user[username]'>Add as Friend</a>

<a href='newfriends.php'>Friend Requests</a>