[Johnson_boy]

That's called mysql injection. You should always escape any user input.

A mean player could join with name '); TRUNCATE TABLE `players`, and it would delete all your users.

So take a look at function mysql_real_escape_string