includes/functions_login.php

 if ($vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'"))

if (!$vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'")) 
{ 
$vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE email = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'"); 
} 
if ($vbulletin->userinfo)