Few issues/comments with your code:
Why use [man]mysql_real_escape_string/man on the ID value? This value appears to be numeric, which means that using a string escaping function is inappropriate. For integers, you should instead consider using [man]intval/man or casting the data to an (int) in order to sanitize the data.
However, perhaps an even better solution would be to first check if the given user-supplied input is an integer. Quickest way I can think of doing this would be something like:
$input = "23";
if($input == (int)$input)
echo "It's an integer!";
else
echo "It isn't an integer!";
Be careful with the [man]empty/man function - it considers '0' to be "empty," while in many applications this is a perfectly valid non-empty value.
Why the separate SELECT/UPDATE queries? For one, this can lead to a race condition; if two executions of this script are occurring simultaneously, they may both SELECT the same value, add one to it, and then both attempt to UPDATE the database. Thus, two hits would only add one. This could theoretically be extended out to n hits, since they could all SELECT the same value.
Instead, why not just execute the UPDATE statement itself? There's no need to SELECT the previous hit count and add one - MySQL is perfectly capable of performing simple addition on its own.
Also, where is $NZTimeString ever defined in your script? If "LAST_UPDATE" is indeed meant to be updated for every UPDATE query, perhaps you should instead consider using a "TIMESTAMP" column and set it to automatically update the record with the current timestamp whenever the row is UPDATE'd? This would simplify your query and allow the DB to enforce this behavior for you automagically.
In your INSERT query, is the 'ID' column an AUTO_INCREMENT column? If so, best practice says that you should simply omit that column altogether from your INSERT queries - MySQL will handle it for you.
From that same query, where is $TimeString ever defined?
You should avoid using 'SELECT *' queries and instead only select the columns from which you actually need data (which, in this case, appears to be only one column - "Link").
EDIT: Forgot to address a couple of the questions you asked:
NZ_Kiwis wrote:HOwever in my database i'm gettings NewsID's of 0 and some like 22423555 which is well above my most resent newsid which is about 800
how can i fix this?
What would you consider a "fix" for this? First, you never validate that the given input is numeric. In other words, I could feed your script and ID of "FOOBAR" and it would still run through all of the queries and populate your DB with invalid data.
Second, you never verify that any of your queries executed successfully and/or as expected (e.g. returned 1 row). In other words, if the SELECT query fails to find any related row based on the given NewsID value, you should detect this and abort the script (and/or gracefully inform the user of a problem). Since you do not do this, however, the subsequent SQL queries will still get executed and thus populate your DB with invalid data.
