Small problem with PHP code?

$sql="SELECT user, passw FROM etna_userbase WHERE user='" . $username . "' AND passw='" . $password . "'";

// note: ; removed and using $password instead of $pass

<?php
	$username	= mysql_real_escape_string($user); // <-- source of $user?
	$password	= mysql_real_escape_string($pass); // <-- source of $pass?

	$sql		= "SELECT user, passw FROM etna_userbase WHERE user='" . $username . "' AND passw='" . $pass . "'";
			
	//echo $sql."<br/>\r\n";
			
	$result = mysql_query($sql) or die('ERROR: '.mysql_error());
			
	//echo $result."<br/>\r\n";
			
	//init not needed in your case... if used outside "while" -> $ans1 = (!isset($ans1)) ? array() : $ans1;
	//$ans1 = array();
	//$ans2 = array();

	while($row = mysql_fetch_array($result)){
		/*
			hmpf ... for what are you checking the resultset?
			you ALREADY FILTERED using WHERE...
			so ALL data in this loop has user=$user and pass=$pass

		$answer1 = $row['user'];
		$answer2 = $row['passw'];
		
		$ans1[] = $answer1;
		$ans2[] = $answer2;
		
		//If the typed out Username IS equal to ONE OF THE Usernames in the database,
		//AND the MD5() OF the typed out Password IS equal to 1 of the MD5() Passwords already
		//in the Database, then return answer with a 1, and send back to program using ETNA
		//Else, send a 0 back to the program using ETNA

		//Code ***MUST*** do this for instance if a user typed in a password that IS in the database,
		//BUT it is NOT THEIR password, then answer should return a 0
		
		if($user == $ans1[0] && MD5($pass) == $ans2[0]){ $answer = 1; } else { $answer = 0; }
		*/

		//doing THIS is enough to store found accounts
		//in most cases you end up with 1 account - else your db data is corrupted
		$foundAccounts[] = $row;
	}

	print "given username: ".$user."<br />";
	print "given passwordHash: ".$password."<br /><br />";

	if(isset($foundAccounts))
		foreach($foundAccounts as $acc) {		
			print "account data:<br /><pre>". print_r($acc,1)."</pre><br />";
		}
	else
		print "<b>no accounts found</b>";
?>