Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function detect_user_id_from_params($params){

    if (!empty($params)) {
        if (isset($params['username']) || isset($params['email'])) {

            if (isset($params['username']) && $params['username'] != false and filter_var($params['username'], FILTER_VALIDATE_EMAIL)) {
                $params['email'] = $params['username'];
            }

            $findUserId = false;
            $findByUsername = false;

            if (isset($params['username'])) {
                $findByUsername = \MicroweberPackages\User\Models\User::where('username', $params['username'])->first();
            }

            if ($findByUsername) {
                $findUserId = $findByUsername->id;
            } else {
                if (isset($params['email'])) {
                    $findByEmail = \MicroweberPackages\User\Models\User::where('email', $params['email'])->first();
                    if ($findByEmail) {
                        $findUserId = $findByEmail->id;
                    }
                }
            }

            if (!$findUserId) {
                return false;
            }

            return $findUserId;
        }
    }

    return false;
}