Ayuda Sql

[alfonz0]

NO BORREN MI POST PLIS U.U
tengo un problema me regresa cualqier password de la bd =S

<?php
$login = stripslashes($_POST['account']);
$name = stripslashes($_POST['name']);
$mes = stripslashes($_POST['mes']);
$dia = stripslashes($_POST['dia']);
$year = stripslashes($_POST['anho']);

require 'config1.php';
$msconnect=mssql_connect("$dbhost","$dbuser","$dbp asswd");
$msdb=mssql_select_db("$db",$msconnect);

if ((eregi("[^a-zA-Z0-9\.@>=<!?*$¬/~+#^ç|_-]", $login))) { echo("<font face='georgia' color='white'><b>Cuenta(ID): Caracteres Invalidos</b></font><br />");exit();}
if ((eregi("[^a-zA-Z0-9\.@>=<!?*$¬/~+#^ç|_-]", $name))) { echo("<font face='georgia' color='white'><b>Nombre de usuario: Caracteres Invalidos</b></font><br />");exit();}
if ((eregi("[^0-9]", $mes))) { echo("<font face='georgia' color='white'><b>mes / dia: Solo Numeros</b></font><br />");exit();}
if ((eregi("[^0-9]", $dia))) { echo("<font face='georgia' color='white'><b>dia / mes: Solo Numeros</b></font><br />");exit();}
if ((eregi("[^0-9]", $year))) { echo("<font face='georgia' color='white'><b>año: Solo Numeros</b></font><br />");exit();}

$msconnect=mssql_connect("$dbhost","$dbuser","$dbp asswd");
$msdb=mssql_select_db("$db",$msconnect);

$sql_username_check = mssql_query("SELECT memb___id FROM MEMB_INFO WHERE memb___id='$login'");
$username_check = mssql_num_rows($sql_username_check);

$sql_deta_check = mssql_query("SELECT addr_deta FROM MEMB_INFO WHERE addr_deta='$mes-$dia-$year'");
$deta_check = mssql_num_rows($sql_deta_check);


$sql_pw_check = mssql_query("SELECT memb__pwd, memb_name FROM MEMB_INFO WHERE memb_name='$name' and memb___id='$login'");
$sql_pw_get = mssql_query("SELECT memb__pwd, addr_deta FROM MEMB_INFO WHERE memb___id='$login'");
$pw_check = mssql_num_rows($sql_pw_check);
$pw_retrieval = mssql_fetch_row( $sql_pw_get );


if (empty($login) || empty($name) || empty($year)) {
echo "<font face='Courier New' color='white'>Algunos espacios fueron dejados en blanco.</font><br>";
}

elseif ($username_check <= 0){
echo "<font face='georgia' color='white'><b>Cuenta Ingresada no existe.</b></font><br>"; }

elseif ($pw_check <= 0){
echo "<font face='georgia' color='white'><b>Nombre de registro es incorrecto.</b></font><br>"; }

elseif ($deta_check <= 0){
echo "<font face='georgia' color='white'><b>Fecha de cumpleaño no es correcto.</b></font><br>"; }

else {
echo "<font face='georgia' color='Red'><b>Password Recuperado Exitosamente</b></font><br/><br/><font face='georgia' color='white'><b>Password:</b> $pw_retrieval[0]</font>"; }


?>