I need a new derailleur
You need to tighten the cable. Also, check that you're not missing a limiter screw, because that looks plain dodgy.

Once the limiters are set up, follow these steps:

1)Set the gear shifter in the highest number (6/7/8 whatever your maximum is).
2)Undo the bolt pinching the cable, the bolt with the spanner on it. This will allow the cable to move freely (if it's not seized up and if you've loosened it enough. But, don't let it go all the way through! 
3)Then push the derailleur manually to the biggest cog whilst turning the pedals and wheel. Push on the 'O' of 'SHIMANO' on your particular derailleur, and it will move the derailleur, and in turn, chain onto the biggest cog. 
4)Allow the slack of the cable through and make sure it's sitting in the inset. Then set the clamp bolt down tight. About as tight as you can with a small 1/4" ratchet from the head of the ratchet. Note, it'll work the same with your nut-style pinch clamp like this pinch-bolt style. 
5)Then, let go of the derailleur and hopefully it'll drop down near the smallest cog. In this image, this is what the bike mechanics where I work call 'Non-Limited'. 
(source: mountainbiketoursthailand.com)  

If it DOESN'T sit on the smallest or second-smallest cog, keep repeating steps 2,4 and 5, pushing the derailleur up to the second largest cog, and then the one next to it each time until it sits on the second cog when you let go. If when you let go, it goes to the second smallest cog, screw in the barrel adjuster until it aligns with the very smallest cog. Then proceed to tighten and loosen it as you need until the gears shift into each cog accurately and easily. 

Very good luck, and if you cannot do this yourself, give it over to a mechanic. I'd personally give it a go if I were you. If you manage it, great! You've saved yourself some money. And if you mess it up, there's not much that can go wrong, nothing is going to really break. You'll just be stuck at square one and need to take it to the mechanic, which is the position you were already in anyway. :)