$search = mysql_query("SELECT * FROM user WHERE username =  '".mysql_real_escape_string($_POST['uname'])."' AND password = '".md5($_POST['upw'])."'");
$searchu = mysql_query("SELECT * FROM user WHERE username =  '".mysql_real_escape_string($_POST['uname'])."'");

#$searchpw = mysql_query("SELECT * FROM user WHERE password = ".md5($_POST['upw']));
if(isset($_POST['uname']))
if(isset($_POST['upw']))
if mysql_num_rows(($search) == 1){

    echo "Erfolgreich eingeloggt.";
    }

elseif(mysql_num_rows($searchu)==1 && mysql_num_rows($search)== 0 ){

    echo "Pw falsch!";
    }

else{

    INSERT INTO user (username, password) VALUES ($_POST['uname'], md5(($_POST['upw'])));
    }