Login whit email for GlobeCMS R2 [FIX]

Hello guys,
I have fixed the login of the GlobeCMS R2 and you can login with your email...
It is 100% functional!!
The code going to bellow:

PHP Code:

---

<?php
require_once("global.php");

$user = $_POST["username"];
$pass = $_POST["password"];

if(empty($user))
{
    // Editado na R2
    $GlobeSecurity->Redirect("./?reason=field_username");
}
elseif(empty($pass))
{
    // Editado na R2
    $GlobeSecurity->Redirect("./?reason=field_password");
}
else
{
    // Login with Username
    $result = mysql_query("SELECT * FROM users WHERE account_name = '".$user."'");
    $user_data = mysql_fetch_array($result);
    $no_rows = mysql_num_rows($result);
    
    // Login with Email
    $resultado = mysql_query("SELECT * FROM users WHERE account_email = '".$user."'");
    $userdata = mysql_fetch_array($resultado);
    $norows = mysql_num_rows($resultado);
    
    if($norows == 1)
    {
        if(sha1($pass) == $userdata["account_password"])
        {
            // Editado na R2
            $_SESSION['login'] = true;
            $_SESSION['id'] = $userdata['id'];
            $_SESSION['account_name'] = $userdata['account_name'];
        
            $GlobeSecurity->Redirect("./me.php");
        }
        else if(sha1($pass) != $userdata["account_password"])
        {
            // Adicionado na R2
            $GlobeSecurity->Redirect("./?reason=login_password");
        }
    }
    elseif($no_rows == 1) 
    {
        if(sha1($pass) == $user_data["account_password"])
        {
            // Editado na R2
            $_SESSION['login'] = true;
            $_SESSION['id'] = $user_data['id'];
            $_SESSION['account_name'] = $user_data['account_name'];
        
            $GlobeSecurity->Redirect("./me.php");
        }
        else if(sha1($pass) != $user_data["account_password"])
        {
            // Adicionado na R2
            $GlobeSecurity->Redirect("./?reason=login_password");
        }
    }
    else if($no_rows == 0 || $norows == 0)
    {
        // Editado na R2
        $GlobeSecurity->Redirect("./?reason=login_username");
    }
}
?>

---

If you don't have the GlobeCMS R2 the link is:
http://forum.ragezone.com/f353/globe...wlight-894030/

Note:
You have to replace your login.php per this

Sorry my English, because i'm portuguese.
Thanks for reading and Enjoy!!

Good, well almost.

There are serval SQL injections to find ;)

And instead of doing 2 queries, you can check if the input is a email or not and choose the best query to execute.

Quote:

---

Originally Posted by joopie

Good, well almost.

There are serval SQL injections to find ;)

And instead of doing 2 queries, you can check if the input is a email or not and choose the best query to execute.

---

Yes i know, but i have the craze to put 2 mysql_query or more :x