Database output function

function output()
{
    // Check authorization
    if(is_authorized())
    {
        $authorized = true;
        include('/path/to/' . $_REQUEST['module'] . '.php');
    }
    echo ""
    $conn = mysql_connect( "dbserver.com:6789", "dbyuser", "dbpassWd" );
    mysql_select_db( "kum", $conn ); // selects a database
    $q = " SELECT * FROM main WHERE id > " . $_GET["id"]. ";";
    $res = mysql_query( $q, $conn);
    while( $row = mysql_fetch_assoc( $res ) )
    {
        echo "".$row['description']."";
    }
    echo "";
    $q = " SELECT * FROM main WHERE id ".$row['description']. "(" .
        $authorized ? $row['status'] : "N/A" . ")";
    }
    echo "";
}

• magic strings,

• DB connection not closed,

• DB errors not handled,

• no prepared statements with safe query parameters,

• injectable request and query parameters,

• mix of UI and logic code,

• no HTML encoding,

• 2 of the 3 comments are very redundant with the line they comment.