[jerx]

Works on vb 3.7.3 pl1. This is the code I used:

// Start hack login with mail address (MarcoH64)
//	if ($vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, infractiongroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'"))
	if (!$vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, infractiongroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'"))
	{
		$vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, infractiongroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE email = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'");
	}
	if ($vbulletin->userinfo)
// End hack login with mail address

Originally Posted by abendagar

Any downside to using

if ($vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, infractiongroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "' OR email = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'"))

Isn't it simpler???

That works, too. Are there any differences between both versions, eg performance, security or stability wise?