I have extended the user profile page in the backend so that each user profile has several extra custom fields for data such as favorite movies, birthday and so on can be stored. Creating a dating website, that is why more fields are needed. People with the proper code can see these profiles in the front end using an entry code which basically is some random code plus userID as number at the end. Using PHP substring the userID is grabbed and access is granted See code:

            echo "<script>
            $getId=substr($_REQUEST['enterCodeId'], 4, 10);
            $querystr ="SELECT ID FROM wp_prefixcode_users WHERE ID='".$getId."'";
            $querystrChecking = mysql_query($querystr);
                echo "<script>
            $uploads = wp_upload_dir(); 

This setup is not ideal because a: the code cannot be added from the profile page yet, which can be remedied with an extra get_the_author_meta(), but I need a better way to generate a password, but also because b: a password will always end in the same userID number.

How can I give users the option to automatically generate an access password from the Dashboard > Users > User Profile so users can regenerate a new access key? This is needed so access given to another user can be revoked. I need a PHP function to generate a new key and get it stored as an author_meta field in the database.


Thanks to Toscho and another dev I got this code to load it all. In functions.php I added:

add_action( 'init', 'accesskeygen_func' );

function accesskeygen_func() {
    $phpfile = explode('/', $_SERVER['PHP_SELF']);
    $phpfile = $phpfile[count($phpfile)-1];

    if (($phpfile=='profile.php') && isset($_GET['accesskeygen'])) {
        echo wp_generate_password();


<!-- begin access key -->
<th><label for="myaccesskey"><?php _e("Access Key"); ?></label></th>
<input type="text" name="myaccesskey" id="myaccesskey" value="<?php echo esc_attr( get_the_author_meta( 'myaccesskey', $user->ID ) ); ?>" class="regular-text" /><br />
<span class="description">
    <input type="button" class="button-secondary" id="myaccesskeygen" value="Generate Access Key"/>&nbsp;
    <?php _e("Please click the button generate access key."); ?>
<!-- end access key -->

1 Answer 1


Use wp_generate_password() to generate passwords. For example, you could add a button to the user profile to get a new password per AJAX.

And you have a security vulnerability in your current code: $getId, the substring from a visitor request may contain malicious code. Always escape request data. Read Data Validation for more information, especially $wpdb->prepare() should be useful.

  • I tried $querystr = $wpdb->prepare("SELECT ID FROM wp_7d8ftw_users WHERE ID='%s'",$getId); but got Fatal error: Call to a member function prepare() on a non-object
    – rhand
    Commented Feb 19, 2012 at 9:15
  • You start with global $wpdb;, do you? ;)
    – fuxia
    Commented Feb 19, 2012 at 11:26
  • Oops. All good now. wp_generate_password() function is next.
    – rhand
    Commented Feb 19, 2012 at 14:00
  • See complete solution in question
    – rhand
    Commented Mar 17, 2012 at 5:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.