<form method="POST" action="">

Username<br />
<input type="text" name="uname"/><br /><br />
Passwort<br />
<input type="text" name="upw"/>

</form>


<?php

$search = mysql_query("SELECT * FROM user WHERE username =  '".mysql_real_escape_string($_POST['uname'])."' AND password = '".md5($_POST['upw'])."'");
$searchu = mysql_query("SELECT * FROM user WHERE username =  '".mysql_real_escape_string($_POST['uname'])."'");

#$searchpw = mysql_query("SELECT * FROM user WHERE password = ".md5($_POST['upw']));
if(isset($_POST['uname']))
    if(isset($_POST['upw']))
        if(mysql_num_rows(($search) == 1)){

           echo "Erfolgreich eingeloggt.";
           }

        elseif((mysql_num_rows($searchu)==1) && (mysql_num_rows($search)== 0 )){

           echo "Pw falsch!";
          }

        else{

          mysql_query("INSERT INTO user (username, password) VALUES('" .$_POST['uname']."','". md5($_POST['upw'])."')");
          }




?>