0

I am currently working on a plugin using WordPress. I created a register page that allow users to register, this information is then stored in custom database table called finusers.

This is what I have done so far:

The code below is used to register users into custom table called finusers.

  function db_insert($emailAdd, $password){
        global $wpdb, $formErr;

        if(1 > count($formErr->get_error_messages())){
            $table = $wpdb->prefix."finusers";
            $checksql = "SELECT * FROM $table WHERE email_address='$emailAdd'";
            $checkdb = $wpdb->query($checksql);

            if($checkdb !=0){
                echo "Email address is registered to a user";
            }else {
                $data = array("email_address"=>$emailAdd, "password"=>$password); 
                $format = array('%s'); 
                $wpdb->insert($table,$data,$format);

                echo "You have successfully registered";
            }
        }
    }

after the user has register, I then use the following function to authenticate the user

 function authenticate($emailAdd, $password){
        global $formErr;

        $username = $emailAdd;
        $password = $password;

        $check = wp_authenticate_username_password(NULL, $username, $password);

        if(1 > count($formErr->get_error_messages())){
            if(is_wp_error($check)){
                echo "Falied";
            }else{
                echo "Success";
            }
        }
    }

The problem that I am having here is, the wp_authenticate_username_password function is checking the the default users table to perform user authentication. How do I make it so that the user authentication is done using the custom table called finusers and not the default table users.

Note: I do realize that code is it is prone to sql injection. Also any suggestions on how I can refine my code will be very helpful

| improve this question | | | | |
  • Why can't you just used the built in user system? – Jacob Peattie Aug 22 '18 at 2:53
  • I only wanted to know if if was possible. I originally thought that I could keep the users who signed up in the custom table separate from the administrative users who data would be stored in the default users table.. – Metal Zer0 Aug 22 '18 at 3:30
  • almost everything is possible with WordPress. if you want more help, edit your question to add more details about what you want to do. – Kaperto Aug 22 '18 at 4:36
  • I will just do that....just tested adding a user to the default user table and the authentication worked. I will edit my question and include what I am working on – Metal Zer0 Aug 22 '18 at 5:41
  • Updated the question with more information... – Metal Zer0 Aug 22 '18 at 21:19
0

After researching and looking up the WordPress Codex and support forums, this is the code that I have used to authenticate users stored in my custom table

add_filter('wp_authenticate_user', 'custom_authentication',10 ,2);
function custom_authentication($emailAdd, $password) {
    global $wpdb, $formErr;

    if(1 > count($formErr->get_error_messages())){
        $table = $wpdb->prefix.'finusers';
        $sql = "SELECT * FROM $table WHERE email_address='$emailAdd' AND password='$password'";
        $authenticate_user = $wpdb->query($sql);

        if($authenticate_user!=0){
            echo "Successful authenticate user";
        }else{
            echo "Failed to authenticate user";
        }
    }
}

I will just post this as my answer it may be helpful to other people.

I am posting an updated answer here. It took me while,but after reading and researching the StackExchange forum, the WordPress codex and more, this is my updated code

add_filter('wp_authenticate_user', 'custom_authentication', 10 , 2);

function custom_authentication($emailAdd, $password) {
    include_once('././wp-includes/class-phpass.php');

    global $wpdb, $formErr;

    if(1 > count($formErr->get_error_messages())){
        $hasher = new PasswordHash(8, TRUE);

        $table = $wpdb->prefix.'finusers';
        $results=$wpdb->get_row("SELECT * FROM $table WHERE email_address='$emailAdd'");
        $hashed_pwd = $results->password;
        //echo $hashed_pwd;

        if($hasher->CheckPassword($password, $hashed_pwd)){
            echo "Password Match Sccuessfully";
        }else{
            echo "Failed to authenticate, please chc";
        }
    }
}

Basically:

  1. added the filter so that I could override the wp_authenticate_user hook and define my own custom authentication function.

  2. Used $wpdb function, to match the email address stored in the database against the email address the user enters in form.

  3. if the email address matched the email address stored in the database, than extract and stored hashed password in a variable, in this case, $hashed_pwd and compared it with the plain text password stored in the variable $password. if the passwords matched user has been successfully authenticated.

  4. One thing to note here is that a another step can be added. This step verifies the users email address; check if the email address exists in the custom table in the WordPress database before checking the password.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.