It's fine.
To make it better, I would check for any possible error after the mysql_select_db(). Don't assume that it selected the database fine.
I would use mysql_escape_string() on the $POST['user'] and $POST['pass'] fields and not just use them directly like that from the HTML form. See below about magic quotes.
I would get rid of the mysql_num_rows() line if you don't have a need to display the number of rows were found ($x). It's an extra call for nothing.
I would use single quotes in the $row index. i.e. $row['company_name']. And here's why:
http://www.php.net/manual/en/language.types.array.php#language.types.array.donts
It's important to know the settings of 'magic_quotes_gpc' and 'magic_quotes_runtime' php.ini settings before using addslashes(), mysql_escape_string(), or stripslashes() on variable data obtained from a HTML form, file or database. Usually the 'magic_quotes_gpc' is on, and 'magic_quotes_runtime' is off. You can find out their settings from within a script by using get_magic_quotes_gpc() and get_magic_quotes_runtime() functions. When these settings are on, PHP has already done the addslashes() for you. Don't arbitrarily do an addslashes() to variables because you could end up having everything double slashed. Do something like this instead:
$last_name = isSet($_REQUEST['last_name']) ? $_REQUEST['last_name'] : '';
if (!get_magic_quotes_gpc()) // When off, do escape
$last_name = mysql_escape_string($last_name); // or use addslashes()
// Here you can add to the table or file fine now
Similarly, after reading from a file or table do not just do stripslashes() routinely because you may strip something in your data that you want to keep. PHP will only do addslashes() to values obtained from a file or table when the 'magic_quotes_runtime' setting is on. Check the setting and do something like this (a database example):
// Do the query and check for errors. The row has O'Brien for a value
while($row = mysql_fetch_assoc($result)) {
if (get_magic_quotes_runtime()) // O\'Brien will be returned
echo stripslashes($row['last_name']); // Strip the backslash
else
echo $row['last_name']; // O'Brien will display fine
}
You don't see that kind of handling a lot because 'magic_quotes_runtime' is usually off by default. However, I recommend that you don't rely on it being off and check for it as shown, or set it off using set_magic_quotes_runtime() function.
Note that the mysql_escape_string() function does a little more than the addslashes().
The mysql_escape_string() returns a string with all characters that could break the query escaped (with a backslash placed before them). The characters that are escaped include null (\x00), new line (\n), carriage return (\r), backslash (), single quote (‘), double quote (“), and CTRL+Z (\x1A). It does not escape percentage (%) and underscore (_) characters. This makes a query safe to use. Anytime user input is used in a query, this function should be used to make the query safe.
The addslashes() does single quote (‘), double quote (“), backslash () and null.
