$search = mysql_query("SELECT * FROM user WHERE username =  '".mysql_real_escape_string($_POST['uname'])."' AND password = '".md5($_POST['upw'])."'");
$searchu = mysql_query("SELECT * FROM user WHERE username =  '".mysql_real_escape_string($_POST['uname'])."'");