Just at a quick look:

1. Get your database access out of your public directory. Any file with database user and password info should go into the root directory.
2. WHERE users_uname='$uname' I don't see $uname initialized.
3. You may be planning to add security later - you'll want regex for this.