ColdFusion "OR" query allowing username or employee number for login - coldfusion

Question

I have a log in page where I am trying to query the database and let the user login by either there employee_number or by there user_name using coldfusion to do so. Is it possible to add the OR employee_number in order to do so? If I remove the OR part it works with just the user name but I am trying to figure out how to let the user use either there user name or employee number. Then no matter which one they enter have the session go by the employee number. Like this <cfset session.employee_number = userVerify.employee_number />
<!--- Get all records from the database that match this users credentials --->
<cfquery name="userVerify" datasource="test">
SELECT *
FROM dbo.Users
WHERE user_name = '#user_name#'
AND user_pass = '#user_pass#'
OR employee_number = '#employee_number#'
AND user_pass = '#user_pass#'
</cfquery>
<cfif userVerify.RecordCount>
<!--- This user has logged in correctly, change the value of the session.allowin value --->
<cfset session.allowin = "True" />
<cfset session.employee_number = userVerify.employee_number />
<!--- Now welcome user and redirect to "index.html" --->
<script>
alert("Welcome <cfoutput>#user_name#</cfoutput>, you have been successfully logged in!");
self.location="../empty_page.html";
</script>
<cfelse>
<!--- this user did not log in correctly, alert and redirect to the login page --->
<script>
alert("Your credentials could not be verified, please try again!");
self.location="Javascript:history.go(-1)";
</script>
</cfif>
PS I know not to use Select * this was just for testing purposes

Answer 1

EDIT: Removed variable employee_number that was in original question since it is not actually a variable being passed in.
<cfquery name="userVerify" datasource="test">
SELECT employee_number
FROM dbo.Users
WHERE user_pass = <cfqueryparam value="#user_pass#" cfsqltype="cf_sql_varchar" />
AND (
user_name = <cfqueryparam value="#user_name#" cfsqltype="cf_sql_varchar" />
OR
employee_number = <cfqueryparam value="#user_name#" cfsqltype="cf_sql_varchar" />
)
</cfquery>

Answer 2

Put brackets around the OR to indicate the precedence:
<cfquery name="userVerify" datasource="test">
SELECT *
FROM dbo.Users
WHERE ( user_name = <cfqueryparam value="#user_name#" cfsqltype="CF_SQL_VARCHAR" />
OR employee_number = <cfqueryparam value="#employee_number#" cfsqltype="CF_SQL_VARCHAR" />
)
AND user_pass = <cfqueryparam value="#user_pass#" cfsqltype="CF_SQL_VARCHAR" />
</cfquery>
(Also, use parameterised queries or you are just asking for SQL injection issues).
Or, to prevent them entering a valid name and invalid id combination (or vice versa) you could do:
<cfquery name="userVerify" datasource="test">
SELECT *
FROM dbo.Users
WHERE ( ( user_name = <cfqueryparam value="#user_name#" cfsqltype="CF_SQL_VARCHAR" null = YesNoFormat( user_name IS "" ) />
AND ( employee_number = <cfqueryparam value="#employee_number#" cfsqltype="CF_SQL_VARCHAR" null = YesNoFormat( employee_number IS "" ) />
OR <cfqueryparam value="#employee_number#" cfsqltype="CF_SQL_VARCHAR" null = YesNoFormat( employee_number IS "" ) /> IS NULL
)
)
OR ( <cfqueryparam value="#user_name#" cfsqltype="CF_SQL_VARCHAR" null = YesNoFormat( user_name IS "" ) /> IS NULL
AND employee_number = <cfqueryparam value="#employee_number#" cfsqltype="CF_SQL_VARCHAR" null = YesNoFormat( employee_number IS "" ) />
)
)
AND user_pass = <cfqueryparam value="#user_pass#" cfsqltype="CF_SQL_VARCHAR" />
</cfquery>

Answer 3

Try this to get the loggedin user or employee details
<cfquery name="userVerify" datasource="test">
SELECT *
FROM dbo.Users
WHERE user_pass = <cfqueryparam value="#user_pass#" cfsqltype="cf_sql_varchar" />
AND (
user_name = <cfqueryparam value="#user_name#" cfsqltype="cf_sql_varchar" />
OR
employee_number = <cfqueryparam value="#employee_number#" cfsqltype="cf_sql_varchar" />
)
</cfquery>