I'm trying to add a password form to the WP registration form. See the code below. I was wondering if I need to sanitize this specific user input? (and if so how?)

If I understand it correctly, WP has sanitizion built in for some things, and passwords may be one of them. Is that correct? Will WP sanitize it automatically before adding it to the database?

add_action( 'register_new_user', 'registration_change_pass', 10, 99 );

function registration_change_pass( $user_id ) {

    if ( isset( $_POST['user_password'] ) ) {
        wp_set_password( $_POST['user_password'], $user_id ); }

1 Answer 1


No, there is no need to sanitize passwords. You don't want to strip out or rewrite a value on users' set passwords. They will be hashed afterwards, so no need

  • 1
    Thanks for confirming what I suspected. Commented Aug 26, 2019 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.