elseif ($_REQUEST['step'] == 'login')

{

    include_once('languages/'. $_CFG['lang']. '/user.php');



    /*

     * 用户登录注册

     */

    if ($_SERVER['REQUEST_METHOD'] == 'GET')

       .....

    else

    {

        include_once('includes/lib_passport.php');

        if (!empty($_POST['act']) && $_POST['act'] == 'signin')

        {

            $captcha = intval($_CFG['captcha']);

            if (($captcha & CAPTCHA_LOGIN) && (!($captcha & CAPTCHA_LOGIN_FAIL) || (($captcha & CAPTCHA_LOGIN_FAIL) && $_SESSION['login_fail'] > 2)) && gd_version() > 0)

            {

                if (empty($_POST['captcha']))

                {

                    show_message($_LANG['invalid_captcha']);

                }



                /* 检查验证码 */

                include_once('includes/cls_captcha.php');



                $validator = new captcha();

                $validator->session_word = 'captcha_login';

                if (!$validator->check_word($_POST['captcha']))

                {

                    show_message($_LANG['invalid_captcha']);

                }

            }



            if ($user->login($_POST['username'], $_POST['password'],isset($_POST['remember'])))

            {

                .....

            }

（

function login($username, $password, $remember = null)

    {

        if ($this->check_user($username, $password) > 0)

        {

            if ($this->need_sync)

            {

                $this->sync($username,$password);

            }

            $this->set_session($username);

            $this->set_cookie($username, $remember);



            return true;

        }

        else

        {

            return false;

        }

    }



function check_user($username, $password = null)

    {



        $post_username = $username;



        /* 如果没有定义密码则只检查用户名 */

        if ($password === null)

        {

            $sql = "SELECT " . $this->field_id .

                   " FROM " . $this->table($this->user_table).

                   " WHERE " . $this->field_name . "='" . $post_username . "'";



            return $this->db->getOne($sql);

        }

        else

        {

            $sql = "SELECT " . $this->field_id .

                   " FROM " . $this->table($this->user_table).

                   " WHERE " . $this->field_name . "='" . $post_username . "' AND " . $this->field_pass . " ='" . $this->compile_password(array('password'=>$password)) . "'";



            return  $this->db->getOne($sql);

        }

    }