As can be seen, the malicious input changes the semantics of the query into a query, a shell command execution and a comment.
This code intends to print a message summary given the message ID.
(bad code)
$id = $_COOKIE["mid"];