danny good try but a few things just on the first few lines...
@include_once(DIRNAME(__FILE__) .'/globals.php');
why?
$st = (isset($_GET['st']) && is_numeric($_GET['ord'])) ? abs(@intval($_GET['st'])) : 0;
$ord= (isset($_GET['ord']) && is_numeric($_GET['ord'])) ? abs(@intval($_GET['ord'])) : 'ASC'; // im confused why numeric if the values will be rather ASC or DESC
$by = (isset($_GET['by']) && ctype_alpha($_GET['by'])) ? strip_tags(mysql_real_escape_string($_GET['by'])) : 'userid'; // so if i put userpass in here what would happen... think about it
maybe try using the good old in_array function it works quite well
[mysql]u.*, g.*, c.cityname, c.cityid[/mysql] why?