<?php
define ('HOSTNAME', 'localhost');
define ('USERNAME', 'indiamm_test');
define ('PASSWORD', 'test');
define ('DATABASE_NAME', 'indiamm_pankaj');

//$test=$_GET['test']; //You aren't using this anywhere

/*
Filter the string, you shouldn't send any external input straight to your DB, it
leaves you open to SQL injection attacks, this uses regular expressions, the arguments are: preg_replace(this, with_this, in_this);
it says:
/ 			= start pattern
[ 			= start range
^ 			= anything that is NOT what follows
A-Za-z0-9 	= upper and lower case letters and numbers
\- 			= the - character, it has to be "escaped" using the \ because it means something else on its own
] 			= end range
/ 			= end pattern

it removes all characters that are not A-Za-z0-9 or a dash
*/
$key = preg_replace("/[^A-Za-z0-9\-]/", '', $_GET['test']);

$db = mysql_connect(HOSTNAME, USERNAME, PASSWORD) OR die ('I cannot connect to MySQL.');
mysql_select_db(DATABASE_NAME);

$result = mysql_query("SELECT `status` FROM `key` WHERE `id`='".$key."';") OR die(mysql_error()); //added single quotes
if(mysql_num_rows($result) > 0) // check if records were returned
{
	print 'VALID'; //Removed double quotes and replaced with single
	//mysql_free_result() removed, you only need this for very large queries 
} else print 'INVALID';
//mysql_close() removed, it would've automatically been closed on the next line anyway
?>