Login Script: mysql_num_rows(): supplied argument is not a valid MySQL result resource

The following script is supposed to validate a username and password in a mysql db.  When entering the username and password of a preregistered user, I get the following errors: Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /var/www/login.php on line 24 Warning: Cannot modify header information - headers already sent by (output started at /var/www/login.php:24) in /var/www/login.php on line 26 On line 24 is: >>>if(!mysql_num_rows($login)) //if the username and pass are wrong --The supplied argument is $login, which is previously defined as: >>>$login = mysql_query("SELECT * FROM 'userinfo' WHERE >>>user = '$user' AND pass = >>>'$pass`"); --which is further defined above it as these values:   $user = $_POST['user']; //pulls the username from the form   $pw = $_POST['pass']; //pulls the pass from the form   $pass = md5($pw); //makes our password an md So why is the sum of those previous definitions an invalid argument for the mysql_query() to test for whether the username and md5 password values are true/equivalent to each other? Thanks for any help you may be able to provide, below is the full login.php page. David ******************************************************** This is the full login.php script, I'm pretty sure no other portions are needed to show at this point for the current problem: <?php $act = $_GET['act']; //retrives the page action if(empty($act)) //if there is no action {   echo('<form action="login.php?act=auth" method="post" name="loginform" id="loginform">   <p>Username   <input type="text" name="user">   </p>   <p>Password   <input type="password" name="pass">   </p>   <p>   <input type="submit" name="Submit" value="Login">   </p>   </form>'); } elseif($act == "auth") //if our page action = auth {   $user = $_POST['user']; //pulls the username from the form   $pw = $_POST['pass']; //pulls the pass from the form   $pass = md5($pw); //makes our password an md5   include("connect.php"); //connects to our mysql database   $login = mysql_query("SELECT * FROM userinfo WHERE user = '$user' AND pass = '$pass`"); //selects info from our table if the row has the same user and pass that our form does   if(!mysql_num_rows($login)) //if the username and pass are wrong   {         header("Location: login.php");  //redirects to our login page         die(); //stops the page from going any further   }   else   {         setcookie("user", $user, time()+3600);//sets our user cookie                 setcookie("pass", $pass, time()+3600);//sets our pass cookie                 header("Location: memprar.php");//instead of yourpage.php it would be your protected page   } } ?>