However if nonsense is typed in - ie. the record is not in the database, all I get is an internal sever error.

Check your server's error logs.

I see a couple of problems. The zero'th problem is that you aren't showing us any code that takes data from a form and injects it into a WHERE clause. How can you expect to us to diagnose a problem when you're not showing us the right code?

Another problem is that you're waiting far too long to print a response header. Do that right up top, before you start opening up database connections and firing off queries.

And I don't think

  print p (end_html);
[download]

is doing what you expect it to do.