[mplode]

Invalid SQL:

SELECT DISTINCT  COUNT(cr.logid) AS count
               FROM((SELECT
                       pm.logid AS logid
                   FROM
                       rcd_log_pm AS pm
                   WHERE
                fromusername = 'Qui's World' ) UNION (SELECT
                       pm.logid AS logid
                   FROM
                       rcd_log_pm AS pm
                   WHERE
                tousername = 'Qui's World' )) AS cr;

Got a bit of an SQL injection going there. Might want to fix that.

edit: two actually. You need to sanitize $user_name

Additionally, there's XSS on the search fields. You need to sanitize those for HTML usage as well. And everywhere where it lists usernames.