How can I ascertain and test SQL injection vunerabilities on this login code?
This is vulnerable:

mysql_real_escape_string($userid);
mysql_real_escape_string($pword);


does not return the variable. Use:

$userid = mysql_real_escape_string($userid);
$pword = mysql_real_escape_string($pword);


If you really want to take care of all vulnerable SQL injections try to move to PDO. Here is a nice tutorial