Account creation fails infuratingly for existing quasi-users about richmondsunlight.com HOT 1 OPEN

Huh. I'm not sure if this ever worked. It's in register.php, where we straight-up test for duplicates by e-mail address

$sql = 'SELECT *
        FROM users
        WHERE email = "' . mysql_real_escape_string($form_data['email']) . '"
        AND password IS NOT NULL';

and issue an error if a match is found. Instead, we should be retrieving the user hash and, if it matches the user hash in the cookie, merge the accounts.

Oh, hey, here's a comment in the code:

# Create a brand-new account. Though it's tempting to merge this new account with
# any existing account data, it's really just more trouble than it's worth.

Huh.

Well, on further reflection, the above SQL is only checking registered accounts (AND password IS NOT NULL), so I think that's working properly. That is, we're not blocking people who have interacted with the site, used their e-mail address, but never created a formal account. I think?

from richmondsunlight.com.