How Authentication in wordpress works? wp_authenticate_username_password()

1 Views
function wp_authenticate_username_password($user, $username, $password) {
if ( is_a($user, 'WP_User') ) { return $user; }

if ( empty($username) || empty($password) ) {
    $error = new WP_Error();

    if ( empty($username) )
        $error->add('empty_username', __('<strong>ERROR</strong>: The username field is empty.'));

    if ( empty($password) )
        $error->add('empty_password', __('<strong>ERROR</strong>: The password field is empty.'));

    return $error;
}

$userdata = get_user_by('login', $username);

if ( !$userdata )
    return new WP_Error('invalid_username', sprintf(__('<strong>ERROR</strong>: Invalid username. <a href="%s" title="Password Lost and Found">Lost your password</a>?'), wp_lostpassword_url()));

if ( is_multisite() ) {
    // Is user marked as spam?
    if ( 1 == $userdata->spam)
        return new WP_Error('invalid_username', __('<strong>ERROR</strong>: Your account has been marked as a spammer.'));

    // Is a user's blog marked as spam?
    if ( !is_super_admin( $userdata->ID ) && isset($userdata->primary_blog) ) {
        $details = get_blog_details( $userdata->primary_blog );
        if ( is_object( $details ) && $details->spam == 1 )
            return new WP_Error('blog_suspended', __('Site Suspended.'));
    }
}

$userdata = apply_filters('wp_authenticate_user', $userdata, $password);
if ( is_wp_error($userdata) )
    return $userdata;

if ( !wp_check_password($password, $userdata->user_pass, $userdata->ID) )
    return new WP_Error( 'incorrect_password', sprintf( __( '<strong>ERROR</strong>: The password you entered for the username <strong>%1$s</strong> is incorrect. <a href="%2$s" title="Password Lost and Found">Lost your password</a>?' ),
    $username, wp_lostpassword_url() ) );

$user =  new WP_User($userdata->ID);
return $user;
}

This is the code i found in wordpress.
but i surfed inside but i cannot able to find where the username or password is retrieved for the database.
i just want to know what query is used by wordpress to retrieve the password and username.

Post Views: 1

Related posts

1 comment

  1. This is the line you’re looking for:

    $userdata = get_user_by('login', $username);

    The get_user_by function calls WP_User::get_data_by and that function eventually executes this SQL:

    SELECT * FROM $wpdb->users WHERE user_login = $username

    The hashed password will be contained in the results of that query. Eventually, the wp_check_password function will be called to compare the hashes.

Comments are closed.