		    $this->error = $langs->trans("ErrorBadCharIntoLoginName");
		    return -1;
		}

		$this->db->begin();

		// Check if login already exists in same entity or into entity 0.
		if (!empty($this->oldcopy) && $this->oldcopy->login != $this->login) {
			$sqltochecklogin = "SELECT COUNT(*) as nb FROM ".MAIN_DB_PREFIX."user WHERE entity IN (".$this->db->sanitize((int) $this->entity).", 0) AND login = '".$this->db->escape($this->login)."'";
			$resqltochecklogin = $this->db->query($sqltochecklogin);
			if ($resqltochecklogin) {
				$objtochecklogin = $this->db->fetch_object($resqltochecklogin);
				if ($objtochecklogin && $objtochecklogin->nb > 0) {
					$langs->load("errors");
					$this->error = $langs->trans("ErrorLoginAlreadyExists", $this->login);
					dol_syslog(get_class($this)."::create ".$this->error, LOG_DEBUG);
					$this->db->rollback();
					return -1;
				}
			}
		}
		if (!empty($this->oldcopy) && $this->email !== '' && $this->oldcopy->email != $this->email) {
			$sqltochecklogin = "SELECT COUNT(*) as nb FROM ".MAIN_DB_PREFIX."user WHERE entity IN (".$this->db->sanitize((int) $this->entity).", 0) AND email = '".$this->db->escape($this->email)."'";
			$resqltochecklogin = $this->db->query($sqltochecklogin);
			if ($resqltochecklogin) {
				$objtochecklogin = $this->db->fetch_object($resqltochecklogin);
				if ($objtochecklogin && $objtochecklogin->nb > 0) {
					$langs->load("errors");
					$this->error = $langs->trans("ErrorEmailAlreadyExists", $this->email);
					dol_syslog(get_class($this)."::create ".$this->error, LOG_DEBUG);
					$this->db->rollback();
					return -1;
				}
			}
		}

		// Update datas
		$sql = "UPDATE ".MAIN_DB_PREFIX."user SET";
		$sql .= " civility = '".$this->db->escape($this->civility_code)."'";
		$sql .= ", lastname = '".$this->db->escape($this->lastname)."'";
		$sql .= ", firstname = '".$this->db->escape($this->firstname)."'";
		$sql .= ", employee = ".(int) $this->employee;
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.