How to fetch details from wp_users id don't know in which format wordpress store password

Question

How to fetch details from wp_users id don't know in which format wordpress store password

$user_login = $_REQUEST['user_login'];
$pwd = md5($_REQUEST['user_pass']);


$sql = "SELECT * from wp_users where user_login='$user_login' and user_pass='$pwd'";
            $sqlQuery = mysql_query($sql);
            $numrows = mysql_num_rows($sqlQuery);
            if($numrows > 0)
            {
                while($loginResult = mysql_fetch_assoc($sqlQuery)){


                    $loginId = $loginResult['user_login'];
                    $email = $loginResult['user_email'];

                    $respond = array("id"=>$loginId,"email"=>$email);

                }

                 echo '{"response": {"message":{"message":"Login Successfully"},"userInfo":'.json_encode($respond).'},"success":true}';

                }else{
                $message = array("message"=> "Invalid Credentials");
                echo '{"success":false,"message":'.json_encode($message).'}';

            }

all the time when this hit it does not shows me Invalid Credentials because of password does not match i guess. please provide a good solution.

Thanks in advance

Answer 1

You can used wp_authenticate_username_password()

Authenticate a user, confirming the username and password are valid

$userName = $_POST['user_login'];
$password = $_POST['user_pass'];
$check = wp_authenticate_username_password( NULL, $userName , $password );

You can then simply check the result with

if(is_wp_error( $check ))
{
  echo 'Wrong'; 
}
else
{
  echo 'Correct';
}

Answer 2

one way is-

Wordpress stores the password using wp_hash_password() function.

You can pass the user password in the function and it will return the encrypted password.

keep in mind that function is written in wp-includes/pluggable.php

another way is-

include '/wp-includes/class-phpass.php');
$hash = $user->user_pass;
$wp_hasher = new PasswordHash(8, TRUE);
$check = $wp_hasher->CheckPassword($password, $hash);

If $check is true, they match.

the reason you can't generate the same hash twice is because of the use of a salt. Salting the password when hashing makes the hash harder to hack using dictionary attacks. This is why generating the hash again and comparing won't work. The hash isn't the same every single time. The check function takes part of the hash (the salt) and the password and recomputes the hash with that salt, thus allowing it to check properly.

hope it helps