Try this;
function createUser(u,p) {
// can get User and Pin fed via function or
//use Data.Get to retrieve Program Settings
var usr = (typeof u === 'undefined' || u=='' ? Data.Get("Username") : u);
var pin = (typeof p === 'undefined' || p=='' ? Data.Get("PIN") : p);
var grp = 'Employee';
var q="SELECT [Id] FROM [UserRoles] WHERE [Name]='" + grp + "'";
var grp = sql.Query(q).First;
// more validation
usr = (typeof usr === 'undefined' ? '' : usr);
pin = (typeof pin === 'undefined' ? '' : pin);
grp = (typeof grp === 'undefined' ? '' : grp);
//check for existing user with that name
var q="SELECT COUNT([Name]) AS [COUNT] FROM [Users] WHERE [Name]='" + usr + "'";
var nameCount = sql.Query(q).First;
//ceck for existing user with that pincode
var q="SELECT COUNT([Name]) AS [COUNT] FROM [Users] WHERE [PinCode]='" + pin + "'";
var pinCount = sql.Query(q).First;
if (usr!='' && pin!='' && grp!='' && nameCount==0 && pinCount==0) {
var addEmployeeAQ = dlg.AskQuestion('Add Employee Named: '+usr+' ?','OK,Cancel');
if ( addEmployeeAQ == 'OK' ) {
// run SQL to create the User
q = "INSERT INTO [Users] ([PinCode], [Name], [UserRole_Id]) VALUES ('" + pin + "', '" + usr + "', '"+grp+"')";
var r = sql.ExecSql(q);
// create user entity
api.Entity(usr).Create('Staff');
dlg.AskQuestion('Employee named '+usr+' added.','OK');
} else {
dlg.AskQuestion('Adding User '+usr+' Aborted','OK');
}
} else {
dlg.AskQuestion('User or PinCode Already in use.','OK');
}
}
Have moved the add question inside the validated stage… no point in asking if its going to fail anyway 
Not tested…
