Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function is_login() {
    global $table_prefeix; // table prefix;

    // If "Don't Signout on inactivity" is not checked and last activity is more then AUTO_LOGOUT_TIME 
    // Then return false and unset session.
    if( isset($_COOKIE["keepAlive"]) !== true and isset($_SESSION["LAST_ACTIVITY"]) and (time() - $_SESSION["LAST_ACTIVITY"]) > AUTO_LOGOUT_TIME ) {

        session_unset();
        return false;

    }
    

    $sesionUserId = isset($_SESSION["uid"]) ? $_SESSION["uid"] : "";
    $sessionPassAccessKey = isset($_SESSION["sak"]) ? $_SESSION["sak"] : "";
    
    // Select the user
    defined('selectUser') ?: define('selectUser', easySelectA(array(
        "table"     => "users as user",
        "fields"    => "user_email, user_emp_id, user_pass_aaccesskey",
        "where"     => array(
            "user.is_trash = 0 and user_id" => $sesionUserId,
            " and user_pass_aaccesskey" => $sessionPassAccessKey
        )
    )));

    // define the variable
    $sha1 = "";

    if( selectUser !== false and isset($_SESSION["keepAliveOnNetworkChanges"]) and $_SESSION["keepAliveOnNetworkChanges"] === 1 ) {
        $sha1 = sha1(selectUser["data"][0]["user_email"].$_SERVER["HTTP_USER_AGENT"]);
    } else if(selectUser !== false) {
        $sha1 = sha1(selectUser["data"][0]["user_email"].$_SERVER["HTTP_USER_AGENT"].$_SERVER["REMOTE_ADDR"]);
    }

    if(isset($_SESSION["uid"]) and isset($_SESSION["sak"]) and $sha1 === $_SESSION["sak"] and isset($_COOKIE["eid"]) and selectUser["count"] === 1 AND selectUser["data"][0]["user_emp_id"] === $_COOKIE["eid"]) {
        
        // Return true to say that we are now logged in.
        return true; 

    } else {

        // If any internal user try to change the eid then ban him to punish
        // Will make it later.
        //if(selectUser["data"][0]["user_emp_id"] !== $_COOKIE["eid"]) { }

        // if any unathorized sessions are set then unset them.
        if( isset($_SESSION) ) {
            session_unset();
        }

        return false;

    }
}