Hvorfor skriver den ik til db´en ??

Hvorfor skriver den ik til db´en
<?php
$connection = mysql_connect(\"localhost\",
                            \"zyga\",
                            \"***t\");
mysql_select_db(\"zyga\", $connection);
if($mini) {
mysql_query(\"UPDATE hanne SET mini=mini+12 WHERE name=$QUERY_STRING\");
  echo \"there will be no escape1\";
}
elseif($medium) {
mysql_query(\"UPDATE hanne SET medium=medium+25 WHERE name=$QUERY_STRING\");
  echo \"there will be no escape2\";
}
elseif($large) {
mysql_query(\"UPDATE hanne SET large=large+75 WHERE name=$QUERY_STRING\");
  echo \"there will be no escape3\";
}
else {
echo \"You Made a mistake\";
}
?>