Unless of course he has register_globals turned on, then it's completely correct and he has a much more severe underlying problem - a poorly configured PHP installation that probably has a plethora of other deprecated and insecure options turned on like magic_quotes_gpc and the like.

Pastebin the entire script or post a link if you could - it looks like you're having a CSS issue and not a PHP one, but it's impossible to tell without having a victim to sacrifice... er, I mean code to look at.