Being paranoid is the only way that you will ever create a script that is secure (although some may argue that nothing can be truly secure for many reasons), you just have to remember that there are alot of little childish 'script kiddies' out there who like to show off there 'l33t haxOr skilz LoLz rOfl', so you really cant let your guard down.

And as for the email HTML issues, i think a pain in the arse is as good a description your going to get without swearing and smashing your head into the monitor repeatedly until you pass out.

Anyway with that little rant over, nice script

__________________
mysql> SELECT * FROM `users` WHERE `users`.`clue` > 0;
Empty set (0.00 sec)