How to check if a user exists by a given id

Question

Is there any way to check if a user id exists? I want to create a function similar to username_exists() but which returns if the id exists or not.

Answer 1

Use this function:

function user_id_exists($user){

    global $wpdb;

    $count = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM $wpdb->users WHERE ID = %d", $user));

    if($count == 1){ return true; }else{ return false; }

}

Usage:

if(user_id_exists(1)){ 
    //it does exists
} else {
    //it doesn't
}

Answer 2

I would highly recommend Daniel's much simpler solution over the one currently selected as correct:

$user = get_userdata( $user_id );
if ( $user === false ) {
    //user id does not exist
} else {
    //user id exists
}

Answer 3

In this case I will definetely not use the get_userdata( $user_id ) while it is returning a WP_User, so it is more greedy than just a custom query.

About the query, I agree using the prepare method, but the SELECT COUNT(*) means you are returning all columns, which is useless here.

I would recommend using SELECT COUNT(ID) unstead, in this way we are only working on a single column which will be faster.

On other aspect for the returning statement, it would be more readable with a Ternary Logic like :

return 1 < $count ? true : false;

To sum up, I wouldd have implemented it like :

function user_id_exists( $user_id ) {
    global $wpdb;
    $count = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(ID) FROM $wpdb->users WHERE ID = %d", $user_id ) );
    return empty( $count ) || 1 > $count ? false : true;
}

Answer 4

If performance is a concern, use:

function user_id_exists($user_id) {
    global $wpdb;

    // Check cache:
    if (wp_cache_get($user_id, 'users')) return true;

    // Check database:
    if ($wpdb->get_var($wpdb->prepare("SELECT EXISTS (SELECT 1 FROM $wpdb->users WHERE ID = %d)", $user_id))) return true;

    return false;
}

Otherwise, use get_userdata($user_id) !== false. The call to get_userdata will retrieve a whole row from the database instead of a single value, create a new WP_User object and cache it on success.

Answer 5

Something that is done by at least a few hackers ( I know because I played victim to this at least once) is to visit your site using this type of URL

domain.com/?author=0

domain.com/?author=1

etc.

On a successful attempt the output of the site will have valid data, in addition the user nicename will be in the content of the website and the nickname may be there as well (depending on the pages output).

On an invalid attempt the site will go to the 404 page (or whatever is set to happen on a page not found error).

It can be rather trivial to build a script using cURL that can test from say author=0 up to author=999 in a relatively short amount of time and output a list of usernames. I had a hacker do this for one of my sites and then try to login to each user by using another list of popular passwords.

As you can imagine the first time this happens it is a bit scary to see that someone can quite easily find out all your usernames. Lucky for me strong passwords saved the day that time, I'm sure not everyone is so lucky.

I have tested this against a couple big name websites (who will remain nameless in this post) and it seems that there may be nothing anyone can do as of yet to stop this from happening. I personally think it is security risk that wordpress should close.

EDIT:

Here in the future (early 2016) I now know that there are methods/plugins which can thwart this user enumeration attack. And I further have changed my stance on the security risk of this and I no longer think WordPress should change this.

Answer 6

Try This will not Showing you the warning like Missing argument 2 for wpdb::prepare()

function user_id_exists($user_id){
    global $wpdb;
    $count = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM $wpdb->users WHERE ID = %d",$user_id));
    if($count == 1){ return true; }else{ return false; }
}