Hi..
Yes your code is working because when your code execute on web server it send something like
...
<a href=$Location onClick='UPDATE hits SET hits='23' WHERE id='1''>SomeTitle</a>
...
See the Html source in your browser???
Now how it is possible that your client will execute your SQL query from his computer and access your database... if so Hacking is easy for me and u...
Now your problem has solution in some client side scripting just use Java script you can do
1) save temprorly in cookie and than update when form is submitted
2) Make your page refresh on each click updatign value in DB
3)Popup a small window with Update query that closes it self when it finish executing your query....
Hope it will help