Bad? That really depends on your perspective. Let's say it's not production ready. There are two camps for web services -- SOAP and REST. SOAP has a huge learning curve while REST (IMHO) is a bit more accessible for beginners. Given your script above and the principles of REST, I would say you should
- use path info for resource access (/id instead of lookup=id)
- use HTTP headers to pass auth tokens
- use HTTP methods to drive what to do with the resource (GET, POST, PUT, DELETE)
- set the content type to application/json if your sending back json
That should give you enough to chew on for a while.