The simplest method would be to do as you suggest. Assume you get from the user:
(1) account [username OR email address]
(2) password
You don't know if 'account' is a username or email address. Ultimately your problem.
A VERY simple way to do this would be to do something like:
$account = 'fromForm';
$password = 'fromForm';
if (strpos($account,'@')===false)
{
//Account is Username
//Do check on username; etc.
}
else
{
//Account is Email
//Do check on email; etc.
}
In order for this to be effective, you will need to ensure that users are NOT allowed to have usernames with '@'. In my system, I tend to restrict usernames to basic alpha/numeric characters a few symbols (dash, underscore, etc). So I wouldn't find it to be an issue. The reason you cannot allow '@' in this case, is because if a '@' is found, PHP will assume it is an email address and attempt to validate by email address.
This is a VERY simple, effective way to do it.
Once you know it is an email, you can do a REGEX match on the email to verify it is a true email address (as Matthew1980 shows). But I find this unnecessary here. This script/code should be validating a login; it really doesn't matter whether the 'email' is valid or not (as an email address), as long as the email is a valid email address within your database/user system. Of course, you'd be advised to verify it is a real email address when an account is registered/created.
