Instead of using the Default WP reset password form, I'm creating my own and I'm stumped on this prepared statement.

I'm trying to update the user's password by checking their user_login and user_activation_key. When I run this query and echo the result, I'm getting a return of int(0). It seems like it's not returning any row of the user.

I also echo each POST variables to make sure it's the values are correct and it is so I'm not sure where the problem lies.

$newpassword = $_POST['newpass'];
$wp_hasher = new PasswordHash(16, FALSE);
$hashedPwd = wp_hash_password($newpassword);

$useremail = $_POST['useremail'];
$key = $_POST['key'];

$resetQuery = $wpdb -> query($wpdb -> prepare("UPDATE wp_users SET user_pass = %s, user_activation_key = '' WHERE user_login = %s AND user_activation_key = %s", 
                                                $hashedPwd, $useremail, $key));

If anyone can please help me, that would be great! Thanks.

  • Why? wp_update_user can do this. – s_ha_dum Jan 7 '14 at 15:50
  • I would rather use wpdb->prepared statements. Any idea why the sql statement doesn't work? I've been pondering on this for a while. – rolu Jan 7 '14 at 15:58
  • 2 questions - are you using the correct table prefix? - is the where condition correct? Try running the query in simple format, then try with prepare statement. – Chittaranjan Jan 7 '14 at 16:38

You are using the user email as the user login. Your code, formatted for readability, looks like:

$resetQuery = $wpdb -> query(
  $wpdb -> prepare(
    "UPDATE wp_users 
    SET user_pass = %s, user_activation_key = '' 
    WHERE user_login = %s AND user_activation_key = %s", 

The $useremail argument matches the user_login = %s placeholder.

Having the user_login match user_email is not normal. Unless you have altered your user registration so that the login always matches the email that isn't going to work, and I suspect that that is your problem. You need to rewrite the query, and/or supporting code, so that either the query matches user_login to user_login or user_email to user_email.

| improve this answer | |
  • How this is different to the actual query? – Chittaranjan Jan 7 '14 at 16:45
  • That is the OP's query. That is confusing. You are right. I'll edit. – s_ha_dum Jan 7 '14 at 16:45
  • @s_ha_dum Thanks for the update. What I forgot was to add the $wpdb->query to the statement. Thanks for your help and suggestions! – rolu Jan 7 '14 at 16:54
  • But your code show $wpdb->query – Chittaranjan Jan 7 '14 at 16:55
  • (Sorry in advance I'm not sure how to structure this comment, lol) The code I posted above returned an INT(0). After changing the format up a bit, (see below), it works. It's basically the same thing @s_ha_dum posted. $resetQuery = $wpdb -> prepare( "UPDATE wp_users SET user_pass = %s, user_activation_key = '' WHERE user_login = %s AND user_activation_key = %s", $hashedPwd, $usernameemail, $key); $wpdb -> query($resetQuery); – rolu Jan 7 '14 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.