I need to find which is the file that checks the DB for correct login (username, password)

Question

I let users to register in my page, however I want to improve the password security that is saved in the DB.

For this I need to find out which is the file that makes the query
where pass=pass and login=login

Which one is it? Thank you.

Answer 1

wp_authenticate_username_password in wp-includes/user.php and wp_check_password in pluggable.php

I would advise against meddling with these though unless you're removing the wordpress user authentification and putting your own in, e.g. http://wordpress.org/extend/plugins/simple-ldap-login/. For the best part, not using the admin username, making the first account a non super admin, not using wp_ database prefix, putting salt values in wp-config.php and setting up your folder permissions/htaccess correctly would do you far more good.

If a hacker has access to your encrypted password hashes, you've already lost the battle.

Answer 2

WordPress uses phppass to store the passwords which is actually the blowfish variable key length cipher, if you are worried about blowfish being cracked you probably should not be using WordPress. If for some reason you dislike blowfish you can replace it, but improve it, that is highly unlikely.