Database output function
magic strings,
DB connection not closed,
DB errors not handled,
no prepared statements with safe query parameters,
injectable request and query parameters,
mix of UI and logic code,
no HTML encoding,
2 of the 3 comments are very redundant with the line they comment.