Currently, wp-register.php checks if the username already exists by running the "username_exists" function found in wp-includes/registration-functions.php.
Next, wp-register.php checks if the email address already exists. Unfortunately, there isn't a valid function like "useremail_exists". Instead, wp-register.php runs a SELECT statement directly.
In addition, the select statement IS NOT SECURE, it doesn't escape characters for the email address variable $user_email.
I believe a proper function useremail_exists() should be created within wp-includes/registration-functions.php which does the email checking properly.
I'll try to see if i can come up with a patch.
Thank you.
