Bad? That really depends on your perspective. Let's say it's not production ready. There are two camps for web services -- SOAP and REST. SOAP has a huge learning curve while REST (IMHO) is a bit more accessible for beginners. Given your script above and the principles of REST, I would say you should

• use path info for resource access (/id instead of lookup=id)
• use HTTP headers to pass auth tokens
• use HTTP methods to drive what to do with the resource (GET, POST, PUT, DELETE)
• set the content type to application/json if your sending back json

That should give you enough to chew on for a while.