Ofcourse it shows the last value. If you insert multiple form elements with the same name and send the form, it will give you the last value with the same name. All xcid's are now in the same form. When you click the flag, it will send all information inside form.
There are multiple solutions to this. You could create the form inside the loop but then it will increase the output size of your script. Probably the easiest would be to just use get method to achieve that and get rid of the form completely eg.:
$flags .= '<tr><td></td><td><a href="display.php?xcid='.$id.'"><img src="'.$flag.'" alt="" /></a></td><td><td></tr>';
Now when someone clicks the flag it will be found in $_GET['xcid'] variable.
There are other ways also but this is the easiest.