	public function authenticate_by_email($website, $email, $password)
    {
        global $DB;

        // find the webuser username assigned to an email address
        // because it may exist more than one account with the same email,
        // only the first _created_ will be used

        $username = $DB->query_single(
            'username',
            'nv_webusers',
            'website = '.intval($website).' AND email = '.protect($email)
        );

        if(empty($username))
            return false;

        return $this->authenticate($website, $username, $password);
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.