Does this query the secured one?
Code:
                database_connect()
                $query="SELECT id
				FROM users
				WHERE username='$un';";
		$result =mysql_query($query) or
		dir(mysql_error($dbconn));
		if(mysql_num_rows($result) < 1)
		{
			die("No such users, Cant create directory");
		}
		$userdata=mysql_fetch_array($result,MYSQL_ASSOC);
		$userid = $userdata['id'];
		mkdir("images/avatar/".$userid,0777) or
		dir("Cant create directory");