ecshop验证用户名密码是否合法

[代码]php代码：

//检查用户名与密码是否合法
    $sql="SELECT `ec_salt` FROM ". $ecs->table('users') ."WHERE user_name = '" . $_POST['user_name']."'";
    $ec_salt =$db->getOne($sql);
    if(!empty($ec_salt))
    {
         /* 检查密码是否正确 */
         $sql = "SELECT user_id".
            " FROM " . $ecs->table('users') .
            " WHERE user_name = '" . $_POST['user_name']. "' AND password = '" . md5(md5($_POST['user_password']).$ec_salt) . "'";
    }
    else
    {
         /* 检查密码是否正确 */
         $sql = "SELECT user_id".
            " FROM " . $ecs->table('users') .
            " WHERE user_name = '" . $_POST['user_name']. "' AND password = '" . md5($_POST['user_password']) . "'";
    }
    $row = $db->getRow($sql);
   
    //验证用户密码正确之后扣除用户积分
    if ($row)
    {
           //验证合法的操作
    }
    else {
        sys_msg("用户名或密码错误！", 1);
    }