You concatenated $_GET['name'] straight into the query and called it a search feature. Somewhere a script kiddie just got a free pass to your entire users table, and the empty password check isn't even the worst part.