function wp_authenticate_username_password($user, $username, $password) {
if ( is_a($user, 'WP_User') ) { return $user; }

if ( empty($username) || empty($password) ) {
    $error = new WP_Error();

    if ( empty($username) )
        $error->add('empty_username', __('<strong>ERROR</strong>: The username field is empty.'));

    if ( empty($password) )
        $error->add('empty_password', __('<strong>ERROR</strong>: The password field is empty.'));

    return $error;

$userdata = get_user_by('login', $username);

if ( !$userdata )
    return new WP_Error('invalid_username', sprintf(__('<strong>ERROR</strong>: Invalid username. <a href="%s" title="Password Lost and Found">Lost your password</a>?'), wp_lostpassword_url()));

if ( is_multisite() ) {
    // Is user marked as spam?
    if ( 1 == $userdata->spam)
        return new WP_Error('invalid_username', __('<strong>ERROR</strong>: Your account has been marked as a spammer.'));

    // Is a user's blog marked as spam?
    if ( !is_super_admin( $userdata->ID ) && isset($userdata->primary_blog) ) {
        $details = get_blog_details( $userdata->primary_blog );
        if ( is_object( $details ) && $details->spam == 1 )
            return new WP_Error('blog_suspended', __('Site Suspended.'));

$userdata = apply_filters('wp_authenticate_user', $userdata, $password);
if ( is_wp_error($userdata) )
    return $userdata;

if ( !wp_check_password($password, $userdata->user_pass, $userdata->ID) )
    return new WP_Error( 'incorrect_password', sprintf( __( '<strong>ERROR</strong>: The password you entered for the username <strong>%1$s</strong> is incorrect. <a href="%2$s" title="Password Lost and Found">Lost your password</a>?' ),
    $username, wp_lostpassword_url() ) );

$user =  new WP_User($userdata->ID);
return $user;

This is the code i found in wordpress. but i surfed inside but i cannot able to find where the username or password is retrieved for the database. i just want to know what query is used by wordpress to retrieve the password and username.

  • In this case the username and password is supplied by the user in the login form. This function is checking if the credentials are valid.
    – user42826
    Commented Dec 26, 2013 at 5:46

1 Answer 1


This is the line you're looking for:

$userdata = get_user_by('login', $username);

The get_user_by function calls WP_User::get_data_by and that function eventually executes this SQL:

SELECT * FROM $wpdb->users WHERE user_login = $username

The hashed password will be contained in the results of that query. Eventually, the wp_check_password function will be called to compare the hashes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.