client.println("HTTP/1.1\r\n");
println already prints the CR LF, you are printing it twice, so the request is invalid (the server sees the headers as the body).
Your biggest mistake is that you completely ignore the response of the server. It would've told you what's wrong with the request.
But the vulnerabilities in your PHP script are even worse: you should read up on SQL injection.
Use PDO and prepared statements instead of mysqli and strings.
http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers
Pieter