Extern validation issue...

//
// Use this to display 'news' - the recent topics from a specific forum
// expanded to include the first post text, posters, comments, etc.
//

else if ($_GET['action'] == 'news')
{
    $order_by = ($_GET['action'] == 'active') ? 't.last_post' : 't.posted';
    $forum_sql = '';

    // Get the forum id(s) you'd like to post news from
    if (isset($_GET['fid']) && $_GET['fid'] != '')
    {
        $fids = explode(',', trim($_GET['fid']));
        $fids = array_map('intval', $fids);

        if (!empty($fids))
            $forum_sql = ' AND f.id IN('.implode(',', $fids).')';
    }

    // RSS support not implemented, if anyone wants to do it, feel free..
    if (isset($_GET['type']) && strtoupper($_GET['type']) == 'RSS')
    {    
    }
    // Regular HTML output
    else
    {
        $show = isset($_GET['show']) ? intval($_GET['show']) : $show_default_topics;
        if ($show < 1 || $show > $show_max_topics)
            $show = $show_default_topics;        

        $result = $db->query('SELECT t.id, t.poster, t.subject, t.posted, t.last_post, t.num_replies, t.num_views, f.id AS fid, f.forum_name FROM '.$db_prefix.'topics AS t INNER JOIN '.$db_prefix.'forums AS f ON t.forum_id=f.id WHERE t.moved_to IS NULL '.$forum_sql.' ORDER BY '.$order_by.' DESC LIMIT '.$show.' ') or error('Unable to fetch topic list', __FILE__, __LINE__, $db->error());
        $show_count = 0;

        if(!$db->num_rows($result))
        {
            echo "No news to display";
        }
        else
        {

            while ( ($show_count < $show) && ($cur_topic = $db->fetch_assoc($result)) ) 
            {
                echo "<div class=newsblock>";
                $temp = '';
                if ($pun_config['o_censoring'] == '1')
                    $cur_topic['subject'] = censor_words($cur_topic['subject']);
                if (pun_strlen($cur_topic['subject']) > $max_subject_length)
                    $subject_truncated = trim(substr($cur_topic['subject'], 0, ($max_subject_length-5))).' ...';
                else
                    $subject_truncated = $cur_topic['subject'];

                // Simplify frequently required display information
                $thisdate = date('l, d F Y', $cur_topic['posted']);
                $poster = $cur_topic['poster'];
                $comments = $cur_topic['num_replies'];
                $views = $cur_topic['num_views'];

                // If using headlines, then after first item only show headlines...
                if(isset($_GET['headlines']) && $show_count > 0)
                {
                    echo "<p class=\"newsheadline\"><a href=".$pun_config['o_base_url']."/viewtopic.php?id=".$cur_topic['id'].">$subject_truncated</a> ($comments)</p> \n";
                }
                else
                {
                    // DISPLAY FOR TITLE OF NEWS
                    echo "<p class=\"newstitle\"><h2><b><a href=".$pun_config['o_base_url']."/viewtopic.php?id=".$cur_topic['id'].">$subject_truncated</a></b></h2></p> \n";

                    $id = $cur_topic['id'];
                    $msg = $db->query('SELECT id, poster, poster_id, poster_ip, poster_email, message, posted, edited, edited_by FROM '.$db_prefix.'posts WHERE topic_id='.$id.' LIMIT 1') or error('Unable to fetch post info', __FILE__, __LINE__, $db->error());
                    if ( !$db->num_rows($msg) ) continue;

                    $cur_post = $db->fetch_assoc($msg);
                    $posterid = $cur_post['poster_id'];    

                    // DISPLAY FOR "Posted on DATE by POSTER"
                    echo "<p class=\"newsdetails\">Posted on $thisdate by <a href=".$pun_config['o_base_url']."/profile.php?id=$posterid>$poster</a></p> \n";

                    $truncate = isset($_GET['summary']) ? 1 : 0;
                    if ($truncate == 1)
                    {
                        $paragraph = preg_split("/\s*\n+/", $cur_post['message']);
                        if (isset($paragraph[1])) 
                        {
                            $cur_post['message'] = $paragraph[0] . "...";
                        }
                    }

                    $message = parse_message($cur_post['message'], 0);            
                    echo "<p class=\"newstext\">$message";
                    if ($truncate == 1) { echo "<p><a href=".$pun_config['o_base_url']."/viewtopic.php?id=".$cur_topic['id'].">Read More...</a></p>"; }
                    echo "</p> \n";

                    echo "<p class=\"newsextra\">Comments(<a href=".$pun_config['o_base_url']."/viewtopic.php?id=".$cur_topic['id'].">$comments</a>) | Views (<a href=".$pun_config['o_base_url']."/viewtopic.php?id=".$cur_topic['id'].">$views</a>) <br /><hr /></p> \n";                
                }
                echo "</div>"; // end newsblock div
                $show_count++;
            }
        }
    }
}
else
    exit('Bad request');