Have you checked what timezone the server is using?
btw you’ve got a bigger problem then that, the old mysql_* extension which your code uses is depreceated in version 5.5 of PHP and is being removed in version 7 of PHP. You really need to be migrating your codebase over to either the mysqli_* extension or to PDO (PDO is better then the mysqli_* extension is it’s database server independent - apart from when you use any sql syntax specific to a particular database server - and it allows for named parameters.
Get into the habit once you’ve migrated over to either rthe mysqli_* extension or PDO of always using prepared statements when dealing with any user submitted data to prevent SQL Injection attacks. All user submitted data needs to be validated before it’s let anywhere near to the database.