[Snippet] WebLogin PE 1.3.1 — проблемы

		// Check username for bullshit.
		if(preg_match('/^[a-z0-9_\\d]+$/', $username) !==false)
		{
			// Check username length 
			if (strlen($username) > 100)
		{
			return $this->FormatMessage($this->LanguageArray[1]);
		} 
		
		}
		else
		{
			return $this->FormatMessage($this->LanguageArray[32]);
		}

		if($username == !preg_match('/^[A-z0-9_\\d]+$/', $username))
		{
			return $this->FormatMessage($this->LanguageArray[32]);
		}

				if(md5($_POST['oldpassword']) !== $modx->db->query("SELECT `password` FROM ".$web_users." WHERE `id` = '".$internalKey."'"))
					{ 
						$this->FormatMessage($this->LanguageArray[18]");
						return;
					}

/**
	 * SaveUserProfile
	 * Updates the web_user_attributes table for a given internalKey.
	 *
	 * @return void
	 * @author Scotty Delicious
	 */
	function SaveUserProfile($internalKey = '')
	{
		global $modx;
		if ($internalKey == '' || empty($internalKey))
		{
			$currentWebUser = $modx->getWebUserInfo($modx->getLoginUserID());
			$internalKey = $currentWebUser['internalKey'];
			$refreshSession = true;
		}
		else
		{
			$currentWebUser = $modx->getWebUserInfo($internalKey);
			$refreshSession = false;
		}
		
		$web_users = $modx->getFullTableName('web_users');
		$web_user_attributes = $modx->getFullTableName('web_user_attributes');
		
		$checkpwd = "SELECT `password` FROM ".$web_users." WHERE `id` = '".$internalKey."'";
		$getpwd = $modx->db->query($checkpwd);
		

		
		

		// EVENT: OnBeforeWebSaveUser
		$this->OnBeforeWebSaveUser(array(), array()); // pixelchutes
		if (!empty($this->Report) ) return; // pixelchutes
		
		while ($row = $modx->db->getRow($getpwd)) {
		$password = $row[password];
		}
		
		if (!empty($_POST['newpassword']) && isset($_POST['newpassword']) && isset($_POST['newpassword_confirm'])) // pixelchutes
		{
			if ($_POST['newpassword'] === $_POST['newpassword_confirm']) // pixelchutes
			{
				if (md5($_POST['oldpassword']) !== $password)
					{ 
						$this->FormatMessage($this->LanguageArray[18]);
						return;
					}
				if (md5($_POST['newpassword']) === md5($modx->db->escape(strip_tags($_POST['newpassword']))))
				{
					if (strlen($_POST['newpassword']) > 5)
					{
						$passwordElement = "UPDATE ".$web_users." SET `password`='".md5($modx->db->escape($_POST['newpassword']))."' WHERE `id`='".$internalKey."'";
						$saveMyPassword = $modx->db->query($passwordElement);
					}
					else
					{
						$this->FormatMessage($this->LanguageArray[3]);
						return;
					}
				}
				else
				{
					$this->FormatMessage($this->LanguageArray[4]);
					return;
				}
			}
			else
			{
				$this->FormatMessage($this->LanguageArray[2]);
				return;
			}
		}
		
		// Check for arrays and that "confirm" fields match.
		foreach ($_POST as $field => $value)
		{
			if (is_array($_POST[$field]))
			{
				$_POST[$field] = implode('||', $_POST[$field]);
			}
			
			$confirm = $field.'_confirm';
			if (isset($_POST[$confirm]))
			{
				if ($_POST[$field] !== $_POST[$confirm])
				{
					$error = $this->LanguageArray[2].' <br />';
					$fieldMessage .= str_replace('[+000+]', '"'.$field.'"', $error);
				}
			}
		}
		
		// If confirm fields were mismatched, throw this error:
		if (!empty($fieldMessage))
		{
			$err = $fieldMessage;
			unset($fieldMessage);
			return $this->FormatMessage($err);
		}
		
		$generalElementsArray = array('fullname','email','phone','mobilephone','dob','gender','country','state','zip','fax','photo','comment');
		$generalElementsUpdate = array();
		
		// CREDIT: Guillaume to delete data and for code optimisation
		foreach ($generalElementsArray as $field)
		{
			if ($field == 'photo')
			{
				if ($_FILES['photo']['name'] !== '' && !empty($_FILES['photo']['name']))
				{
					$_POST['photo'] = $this->CreateUserImage();
					if (!empty($this->Report))
					{
						return;
					}
				}
			}
			if ($field == 'dob' && trim($_POST['dob'])!='') // for not format an empty date else date is 0 (01-01-1970)
			{
				$_POST['dob'] = $this->MakeDateForDb($_POST['dob']);
			}
			if ($field!='photo' || ($_FILES['photo']['name'] !== '' && !empty($_FILES['photo']['name']))) // for update db with value and blank value (except if the field is 'photo')
{
	// CREDIT: Mike Reid (aka Pixelchutes) for the string escape code.
	$charset='"'.$modx->config['modx_charset'].'"';
	$generalElementsUpdate[] = " `".$field."` = '".$modx->db->escape(stripslashes(htmlspecialchars(trim($_POST[$field]), ENT_QUOTES, $modx->config['modx_charset'])))."'";
}
//			{
				// CREDIT: Mike Reid (aka Pixelchutes) for the string escape code.
//				$charset=$modx->config['modx_charset'];
//				$generalElementsUpdate[] = " `".$field."` = '".$modx->db->escape(stripslashes(htmlentities(trim($_POST[$field]), ENT_QUOTES, $modx->config['modx_charset']))).	"'";
//			}
		}

		if (!empty($this->CustomFields) && $this->CustomFields !== '')
		{
			$checkForExtended = "SELECT * FROM ".$this->CustomTable." WHERE `internalKey` = '".$internalKey."'";
			$isExtended = $modx->db->query($checkForExtended);
			$extendedRows = $modx->db->getRow($isExtended);
			
			if (!empty($extendedRows))
			{
				$extendedFieldValues = array();
				foreach ($this->CustomFields as $field)
				{
					// CREDIT: Mike Reid (aka Pixelchutes) for the string escape code.
					$extendedFieldValues[] = " `".$field."` = '".$modx->db->escape(stripslashes(trim($_POST[$field])))."'";
				}
				$this->OnBeforeWebSaveUser($generalElementsUpdate, $extendedFieldValues);
				
				$extendedUserAttr = "UPDATE ".$this->CustomTable." SET".implode(', ', $extendedFieldValues)." WHERE `internalkey` = '".$internalKey."'";
			}
			else
			{
				$extendedFieldValues = array();
				foreach ($this->CustomFields as $field)
				{
					// CREDIT: Mike Reid (aka Pixelchutes) for the string escape code.
					$charset=$modx->config['modx_charset'];
					$extendedFieldValues[$field] = $modx->db->escape(stripslashes(htmlentities(trim($_POST[$field]), ENT_QUOTES,$charset)));
				}
				$this->OnBeforeWebSaveUser($generalElementsUpdate, $extendedFieldValues);
				
				$extendedFieldValues = implode("', '", $extendedFieldValues);
				$extendedFields = implode('`, `', $this->CustomFields);
				$extendedUserAttr = "INSERT INTO ".$this->CustomTable." (`internalKey`, `".$extendedFields."`) VALUES ('".$internalKey."', '".$extendedFieldValues."')";
			}
		}
		// Prepare the query for General Elements
		$generalElementsSQL = "UPDATE ".$web_user_attributes." SET ".implode(', ', $generalElementsUpdate)." WHERE `internalkey` = '".$internalKey."'";
		
		// Execute the database queries.
		if( count($generalElementsUpdate) > 0 ) $saveMyProfile = $modx->db->query($generalElementsSQL);
		if (!empty($this->CustomFields) && $this->CustomFields !== '')
		{
			$insertExtendedAttr = $modx->db->query($extendedUserAttr);			
		}
		
		$this->User = $this->QueryDbForUser($currentWebUser['username']);
		$this->OnWebSaveUser('update', $this->User);
		
		if ($refreshSession === true)
		{
			$this->SessionHandler('start');
		}
		
		$this->FormatMessage($this->LanguageArray[101]);
	}
	

Текущий пароль: <input id="wlpeUserProfilePassword" type="password" name="oldpassword" value="" />