Not a bad script, seems like it does its job fairly well. It isn't really a CMS though; it's just a script.

Took a brief look though and here are some things I noticed:
You only need to use mysql_real_escape_string, stripshashes is not necessary in conjunction. That can actually create errors. Make sure you run mysql_real_escape_string on everything you put into the database.

"if your using Cpanel it should be cpaneluser_username" This is not true, the two are very often different. Same goes for database name.

The gun company Glock may not like you saying that they are the author. That is what the meta-data would imply.


It's still not a bad script, I didnt run it but it appears to do it job fairly well.

Not all of your admin pages are secured

If you make more than one admin account everything will display that many times since the secured content is in a while loop.