Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Possible Duplicate:
How to validate WordPress generated password in DB using PHP?

I am working with site that is done with WordPress, and I need to add some parts that are outside WP, and to check user login, but I can't find how WP is encrypting password before it writes it in DB...

I tried with md5 but it's not...

Does anyone know how to check password outside WP, without using it's pluggins/checkers, clear PHP code?

share|improve this question
    
Closing this as a duplicate of the question @SharkTheDark actually has the ability to accept answers to ... –  EAMann Oct 25 '11 at 2:58
add comment

migrated from stackoverflow.com Oct 24 '11 at 21:02

This question came from our site for professional and enthusiast programmers.

marked as duplicate by EAMann Oct 25 '11 at 2:58

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

4 Answers

The password encryption library is in /wp-includes/class-phpass.php. It is the Portable PHP Password hashing framework.

share|improve this answer
    
Can you write some samples how to use it? Since it's WP Plugin again, not clear PHP as I asked, but if you can write how to use it inside PHP it will be useful... –  SharkTheDark Oct 24 '11 at 21:21
    
This isn't a WordPress plugin. This is a standard PHP class file that is included with the WordPress framework. You just include it in a new PHP file, create an instance, and use it. –  John Watson Oct 24 '11 at 21:40
add comment

It sounds like you want to use external code to validate usernames/passwords against WP's database. If that's correct, you're going to spend a lot of time reinventing the wheel. But for a good example of how to do this using straight PHP, it's a good idea to take a look at the core WP functions that already do it.

Case in point, `wp_check_password()':

function wp_check_password($password, $hash, $user_id = '') {
    global $wp_hasher;

    // If the hash is still md5...
    if ( strlen($hash) <= 32 ) {
        $check = ( $hash == md5($password) );
        if ( $check && $user_id ) {
            // Rehash using new hash.
            wp_set_password($password, $user_id);
            $hash = wp_hash_password($password);
        }

        return apply_filters('check_password', $check, $password, $hash, $user_id);
    }

    // If the stored hash is longer than an MD5, presume the
    // new style phpass portable hash.
    if ( empty($wp_hasher) ) {
        require_once ( ABSPATH . 'wp-includes/class-phpass.php');
        // By default, use the portable hash from phpass
        $wp_hasher = new PasswordHash(8, TRUE);
    }

    $check = $wp_hasher->CheckPassword($password, $hash);

    return apply_filters('check_password', $check, $password, $hash, $user_id);
}

First, WordPress checks to see if the user's hashed password is still using old-school MD5 for security. This is to preserve backwards compatibility for updates. If the password is MD5, then WordPress will automatically replace it with a new hash using the new system (the call to wp_set_password()). If it isn't MD5, then WP moves on to the newer hashing setup.

First, we include the Portable PHP Hashing Framework (already mentioned by @John Watson in another answer) and create an instance of it, storing it in the global $wp_hasher variable.

We then pass in the plaintext password and the hash to verify it against, using the CheckPassword() method of the library.

If you want to use this in an external library, you'll have to first include/require the library, then instantiate it, then pass in your plain text password and its hash. So some untested psuedo-code ...

function validate_password( $plaintext, $hash ) {
    require_one( 'class-phpass.php' );
    $hasher = new PasswordHash(8, TRUE);

    return $hasher->CheckPassword( $plaintext, $hash );
}
share|improve this answer
add comment
require_once( '/path/to/wp-includes/class-phpass.php' );
$wp_hasher = new PasswordHash( 8, TRUE );
$password = 'swordfish';
$hashed_password = $wp_hasher->HashPassword( $password );
share|improve this answer
add comment

So I get:

$P$BqVYujC/jqNY4aylZpHi475jwcaSUs1

But how can I compare that with one in DB?

One in DB is:

fa063a4ed35e092a2d4e15c1b6a61871

How to compare those two with MySQL?

I need something that I will use in this:

SELECT * FROM wp_customers WHERE email = "ccc@aaa.com" AND password = "<what goes here?>"

I tried encrypting this with md5, but no luck...

Btw. Sorry for putting this into Answer, I don't have enough reputation on this part of site to post comments on answers...

share|improve this answer
add comment