WordPress user Authentication

Question

I am currently working on a plugin using WordPress. I created a register page that allow users to register, this information is then stored in custom database table called finusers.

This is what I have done so far:

The code below is used to register users into custom table called finusers.

  function db_insert($emailAdd, $password){
        global $wpdb, $formErr;

        if(1 > count($formErr->get_error_messages())){
            $table = $wpdb->prefix."finusers";
            $checksql = "SELECT * FROM $table WHERE email_address='$emailAdd'";
            $checkdb = $wpdb->query($checksql);

            if($checkdb !=0){
                echo "Email address is registered to a user";
            }else {
                $data = array("email_address"=>$emailAdd, "password"=>$password); 
                $format = array('%s'); 
                $wpdb->insert($table,$data,$format);

                echo "You have successfully registered";
            }
        }
    }

after the user has register, I then use the following function to authenticate the user

 function authenticate($emailAdd, $password){
        global $formErr;

        $username = $emailAdd;
        $password = $password;

        $check = wp_authenticate_username_password(NULL, $username, $password);

        if(1 > count($formErr->get_error_messages())){
            if(is_wp_error($check)){
                echo "Falied";
            }else{
                echo "Success";
            }
        }
    }

The problem that I am having here is, the wp_authenticate_username_password function is checking the the default users table to perform user authentication. How do I make it so that the user authentication is done using the custom table called finusers and not the default table users.

Note: I do realize that code is it is prone to sql injection. Also any suggestions on how I can refine my code will be very helpful

Answer 1

After researching and looking up the WordPress Codex, this is the code that I have used to authenticate..

I hope this helpful to all friends .it's working fine for me :)

 $creds = array(
    'user_login'    => $username,
    'user_password' => $userpassword,
    'remember'      => true
 );
 
 if(!empty($username) && !empty($userpassword)) {
    
    if(!username_exists($username)) {

        $userdata = array(
            'user_login'  =>  $username,
            'user_email'  =>  $useremail, 
            'user_pass'   =>  $userpassword, 
            'role'        =>  'customer' 
        );

        $user_id = wp_insert_user( $userdata ) ; 
        
        $user = wp_signon( $creds, false );
        wp_set_current_user($user->ID,$username); 
        wp_set_auth_cookie($user->ID, true, false );  

        wp_redirect(site_url()); 
        
 
    }

Answer 2

After researching and looking up the WordPress Codex and support forums, this is the code that I have used to authenticate users stored in my custom table

add_filter('wp_authenticate_user', 'custom_authentication',10 ,2);
function custom_authentication($emailAdd, $password) {
    global $wpdb, $formErr;

    if(1 > count($formErr->get_error_messages())){
        $table = $wpdb->prefix.'finusers';
        $sql = "SELECT * FROM $table WHERE email_address='$emailAdd' AND password='$password'";
        $authenticate_user = $wpdb->query($sql);

        if($authenticate_user!=0){
            echo "Successful authenticate user";
        }else{
            echo "Failed to authenticate user";
        }
    }
}

I will just post this as my answer it may be helpful to other people.

I am posting an updated answer here. It took me while,but after reading and researching the StackExchange forum, the WordPress codex and more, this is my updated code

add_filter('wp_authenticate_user', 'custom_authentication', 10 , 2);

function custom_authentication($emailAdd, $password) {
    include_once('././wp-includes/class-phpass.php');

    global $wpdb, $formErr;

    if(1 > count($formErr->get_error_messages())){
        $hasher = new PasswordHash(8, TRUE);

        $table = $wpdb->prefix.'finusers';
        $results=$wpdb->get_row("SELECT * FROM $table WHERE email_address='$emailAdd'");
        $hashed_pwd = $results->password;
        //echo $hashed_pwd;

        if($hasher->CheckPassword($password, $hashed_pwd)){
            echo "Password Match Sccuessfully";
        }else{
            echo "Failed to authenticate, please chc";
        }
    }
}

Basically:

1. added the filter so that I could override the wp_authenticate_user hook and define my own custom authentication function.

2. Used $wpdb function, to match the email address stored in the database against the email address the user enters in form.

3. if the email address matched the email address stored in the database, than extract and stored hashed password in a variable, in this case, $hashed_pwd and compared it with the plain text password stored in the variable $password. if the passwords matched user has been successfully authenticated.

4. One thing to note here is that a another step can be added. This step verifies the users email address; check if the email address exists in the custom table in the WordPress database before checking the password.