The script is creating a file with ".db" extension but not as "domain.db"

Then one would think that $domain doesn't contain the string domain.

I am passing the value for the variable $domain from a HTML page

One would hope you don't allow values such as "../../etc/passwd\0"