So we are using a couple of custom things in our WP and one of them is a PW-Recovery form. Using this internally we're setting the password with

wp_set_password($password, $userId)

Lately we realised a problem with passwords containing the apostrophe character "

Setting a password with this will leave the user unable to log in using the same password that was just set. We have applied nothing to the login process and I can verify that the correct password is entered into the wp_set_password() function as well as the login form.

Any pointers as to where I can look for potential errors would be great. Thank you for your time.

Update 1

Using wp_signon() the user is able to login using the password Test"123

Using wp-login.php?page=login and entering the password Test"123 will not work

currently looking for all the filters that could potentionally interfere with this...

Update 2

Looks to me like an undocumented wordpress feature / bug?

All plugins have been deactivated. The unmodified theme twentefifteen has been used. Changing the password using wp_set_password() changes the PW in the database. However using a password with " or ' will result you being unable to login using wp-login.php. It will give you invalid credentials error.

However using the same login data and wp_signon() it works. I'm just clueless, probably forwarding to wp bug forums.

Update 3

I am using this plugin snipped to reset and test the login.

function resetLogin() {
//    wp_set_password('Test"123', 1);
        'ID' => 1,
        'user_pass' => 'Test"123'
//add_action('after_setup_theme', 'resetLogin');

function testLogin() {
        'user_login' => 'admin',
        'user_password' => 'Test"123',
        'remember' => true
    ], false));
//add_action('after_setup_theme', 'testLogin');

To test I am commenting in the add_action - resetLogin once, and deactivate it immediately again before doing anything on the page. This then immediately breaks the login on wp-login.php

  • 1
    You are getting incorrect password message or what happens when a user can't log in? Commented Oct 14, 2015 at 10:03
  • @ThemesCreator correct, sorry for not being explicit enough. Please see the second update. I can only imagine this being a bug.
    – Sam
    Commented Oct 14, 2015 at 10:05
  • 1
    I've been trying with default WordPress form to generate new password and it works perfectly with " and ' characters. It must be something you are doing wrong. Can you show the full code you are using?
    – cybmeta
    Commented Oct 14, 2015 at 10:33
  • @cybmeta the problem clearly lies within the usage of wp_set_password() and/or wp_update_user() - I just ran my test snipped on a naked wordpress installation. (snipped see update 3)
    – Sam
    Commented Oct 14, 2015 at 11:01
  • 1
    @cybmeta Just to ping you again - the issue was that those functions require wp_slash() to be used. This however isn't documented, but will surely be added as now there is an open ticket for it :)
    – Sam
    Commented Oct 14, 2015 at 11:38

2 Answers 2


The resolution is pretty simply. Those functions require the passwords to be properly escaped. So

Instead of this:

wp_set_password('Test"123', $userId);

You have to do this:

wp_set_password(wp_slash('Test"123'), $userId);

The same goes for wp_update_user() and wp_signon(). Further information and updates on the docs may be visible from this bug report:

  • Upvote for answering your own question
    – cybmeta
    Commented Oct 14, 2015 at 12:57
  • 2
    WTF wordpress. That makes no sense what-so-ever. It's the wrong abstraction level to handle sql escaping and passwords aren't even stored in the database directly. Commented Oct 14, 2015 at 13:11
  • @CodesInChaos I think this goes way back to the time of magic quotes. Wordpress still does "addslashes" to every single $_POST and get variable there is. Knowing a little bit of Wordpress's internals doing this is pretty obvious - though getting to the point of realization cost me 6 hours of work Xx for a freaking addslashes.... Xx
    – Sam
    Commented Oct 14, 2015 at 18:44

I am not sure if this exactly what is happening to you, but this is what the codex says about wp_set_password():

Please note: This function should be used sparingly and is really only meant for single-time application. Leveraging this improperly in a plugin or theme could result in an endless loop of password resets if precautions are not taken to ensure it does not execute on every page load.


I think you should only use it to reset the password and then delete it.

  • I am aware of this, thank you. I am using it the way it is meant to be. As far as I can tell there is two ways to update a users password. wp_set_password() and wp_update_user() - both ultimately result in the same outcome :(
    – Sam
    Commented Oct 14, 2015 at 10:23
  • Just to ping you again - the issue was that those functions require wp_slash() to be used. This however isn't documented, but will surely be added as now there is an open ticket for it :)
    – Sam
    Commented Oct 14, 2015 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.