Two issues I see:
- You still run the query even if the email address is blank - surely you don’t want to do that?
- You’re still using the old-style mysql_query() and similar functions, which have been removed from the latest version of PHP.
I would imagine that if you call the function with the session variable not set, that will give the error message you describe. Even if the session variable is set, you should still check to see whether you got any results from the query before you start to use those results. What are you expecting the function to return if the email address is not in the database?