Which hook should I use to capture $_POST('password') via profile update and password reset

Question

I need to rehash the password which the user entered during Wordpress registration (I use WooCommerce)

I'm successfully able to do this with the following:

add_action( 'user_register', 'myplugin_registration_save', 10, 1 );
function myplugin_registration_save( $user_id ) {

    if ( isset( $_POST['password'] ) ) {
        update_user_meta($user_id, 'user_pass2', password_hash($_POST['password'], PASSWORD_DEFAULT));
    }

}

However, I need to do this for 2 more occasions, profile update and reset password

I wrote:

function my_profile_update( $user_id ) {
    if ( ! isset( $_POST['password'] ) || '' == $_POST['password'] ) {
        return;
    }
    update_user_meta($user_id, 'user_pass2', password_hash($_POST['password'], PASSWORD_DEFAULT));
    $x = $_POST['password'];
    echo '<script language="javascript">';
    echo 'alert('.$x.')';
    echo '</script>';


    // password changed...
}
add_action( 'profile_update', 'my_profile_update' );

It doesn' work at all.

UPDATE

function my_profile_update( $user_id ) {

    update_user_meta($user_id, 'user_pass2', (string) $_POST['password']);
    // password changed...
}
add_action( 'profile_update', 'my_profile_update' );

It works but $_POST['password'] or $_POST['pass1'] returns nothing.

Answer 1

Sometimes you have to look at the name of the input you're trying to pick up via $_POST. It's not always consistent across forms. In the case of the WooCommerce password change form, the input name for the new password field is 'password_1' so that's what you need to pick up via $_POST:

function my_profile_update( $user_id ) {

    if ( ! is_admin() ) {
       update_user_meta($user_id, 'user_pass2', (string) $_POST['password_1']);
    }
    // password changed...
}
add_action( 'profile_update', 'my_profile_update' );

When in doubt on the input tag name, use the browser inspector. While hovering your mouse over the field in question, right click and select "inspect". This will highlight the HTML for that field in the inspector and you can look at the value for "name". That's the value you need to use in $_POST.

Also note the addition of checking that the action is not run on the dashboard (admin) side (is_admin()). WooCommerce is using the same action hook as WP to consolidate (something that it sounds like you don't want to do).