function nvweb_webuser_generate_username($email)
{
    global $DB;
    global $website;

    // generate a valid username
    // try to get the left part of the email address, except if it is a common account name
    $username = strtolower(substr($email, 0, strpos($email, '@'))); // left part of the email

    if(!empty($username) && !in_array($username, array('info', 'admin', 'contact', 'demo', 'test')))
    {
        // check if the proposed username already exists,
        // in that case use the full email as username
        // ** if the email already exists, the subscribe process only needs to update the newsletter subscription!
        $wu_id = $DB->query_single(
            'id',
            'nv_webusers',
            ' LOWER(username) = '.protect($username).'
                              AND website = '.$website->id
        );
    }

    if(empty($wu_id))
    {
        // proposed username is valid,
        // continue with the registration
    }
    else if(!empty($wu_id) || empty($username))
    {
        // a webuser with the proposed name already exists... or is empty
        // try using another username -- maybe the full email address?

        $username = $email;

        $wu_id = $DB->query_single(
            'id',
            'nv_webusers',
            ' LOWER(username) = ' . protect($email) . '
                                    AND website = ' . $website->id
        );

        if(empty($wu_id))
        {
            // proposed username is valid,
            // continue with the registration
        }
        else
        {
            // oops, email is already used for another webuser account
            // let's create a unique username and go on
            $username = uniqid($username . '-');
        }
    }

    return $username;
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.