Though you'd still want to check to make sure that they didn't submit img="something stupid".
Have an array of all the legitimate names, e.g.
$imgs = array('kiss', 'heart', [i]etc.[/i]);
And modify the if to read
if(!empty($_POST['img']) && in_array($_POST['img'], $imgs))
The rest as feldon23 suggests.