Comment valider le mot de passe généré par WordPress dans DB en utilisant PHP?

Sur labase de votre autre question ...il semble que vousessayez de valider unmot depasse donnéen textebrutpar rapport à ce quiest stocké dans labase de données. Voici lafonction que WordPress utilisepourfaireexactement cela:

 function wp_check_password($password, $hash, $user_id = '') {
    global $wp_hasher;

    // If the hash is still md5...
    if ( strlen($hash) <= 32 ) {
        $check = ( $hash == md5($password) );
        if ( $check && $user_id ) {
            // Rehash using new hash.
            wp_set_password($password, $user_id);
            $hash = wp_hash_password($password);
        }

        return apply_filters('check_password', $check, $password, $hash, $user_id);
    }

    // If the stored hash is longer than an MD5, presume the
    // new style phpass portable hash.
    if ( empty($wp_hasher) ) {
        require_once ( ABSPATH . 'wp-includes/class-phpass.php');
        // By default, use the portable hash from phpass
        $wp_hasher = new PasswordHash(8, TRUE);
    }

    $check = $wp_hasher->CheckPassword($password, $hash);

    return apply_filters('check_password', $check, $password, $hash, $user_id);
}
 

Premièrement,ceplugin vérifie si le hachage MD5 dumot depasse donnéest lemême que lemot depasse stocké (haché)pour un utilisateur. Il vérifie également si le hachage PHPass dumot depasse donnéest lemême que lemot depasse stocképour un utilisateur.

Vouspouvez suivre unmodèle similaire.

Supposons donc que l'utilisateur vous donne unnom d'utilisateuret unmot depasseet que vous souhaitez les valider (my_password_validation( $username, $password )). Vous utiliserez lenom d'utilisateur donnépourextraire unmot depasse haché de labase de données. Ensuite,vous comparez le hachage dumot depasse donné à la valeur stockéepour voir s'ilest valide.

Voici quelques psuedocodenontestés :

 function my_password_validation( $username, $password ) {
    // Select the users's password hash from the database
    $stored = query( 'SELECT * FROM wp_customers WHERE email = ' . $username );

    require_one( 'class-phpass.php' );
    $hasher = new PasswordHash(8, TRUE);

    return $hasher->CheckPassword( $password, $stored );
}
 

Si lemot depasse que vouspassez à lafonctionest haché sur lamême valeur que la valeur stockée,lafonction retourneratrue. Sinon,il retournerafalse.

En regardant les commentaires que vous avez laissés sur l'autre question,il semble cependant que vous ayez d'autresproblèmes. Pour citer:

Doncj'obtiens:

$P$BqVYujC/jqNY4aylZpHi475jwcaSUs1 Mais commentpuis-je comparer cela avec un dans DB?

Un dans DBest:

fa063a4ed35e092a2d4e15c1b6a61871 Comment comparer ces deux avec MySQL?

Jepeux vous diremaintenant que lemot depasse que vous obtenez de labase de donnéesn'apas été haché à l'aide de l'utilitaire PHPass. Ces hachages ressembleronttoujours au début de $P$B car c'est ce quiindique au système commentil a été haché. PHPassestbasé sur Blowfish qui utilise cegenre depréfixe sur les chaînes cryptées.

Votre hachage fa063... ressembleplus à un hachage MD5 standard ... donc si votre hachage MD5 dutextebrutne correspondpas,alorsje pense que vous avezpeut-être lemauvaismot depasse.

/p>

Pour répondre à votre & quot; comment comparer ces deux avec MySQL & quot; question ... vousne lefaitespas. MySQLest lemagasin de données ...ne faites aucune logiquemétier ou comparaison dans lemagasin de données. Lisez les données,puis utilisez un script PHPpoureffectuer votre comparaison.

Based on your other question ... it sounds like you're trying to validate a given plaintext password against what's stored in the database. Here's the function WordPress uses to do just that:

function wp_check_password($password, $hash, $user_id = '') {
    global $wp_hasher;

    // If the hash is still md5...
    if ( strlen($hash) <= 32 ) {
        $check = ( $hash == md5($password) );
        if ( $check && $user_id ) {
            // Rehash using new hash.
            wp_set_password($password, $user_id);
            $hash = wp_hash_password($password);
        }

        return apply_filters('check_password', $check, $password, $hash, $user_id);
    }

    // If the stored hash is longer than an MD5, presume the
    // new style phpass portable hash.
    if ( empty($wp_hasher) ) {
        require_once ( ABSPATH . 'wp-includes/class-phpass.php');
        // By default, use the portable hash from phpass
        $wp_hasher = new PasswordHash(8, TRUE);
    }

    $check = $wp_hasher->CheckPassword($password, $hash);

    return apply_filters('check_password', $check, $password, $hash, $user_id);
}

First, this plugin checks to see if the MD5 hash of the given password is the same as the stored (hashed) password for a user. It also checks to see if the PHPass hash of the given password is the same as the stored password for a user.

You can follow a similar pattern.

So let's say you're given a username and a password from the user and you want to validate them (my_password_validation( $username, $password )). You'll use the given username to pull a hashed password from the database. Then you compare the hash of the given password to the stored value to see if it's valid.

Here's some untested psuedocode:

function my_password_validation( $username, $password ) {
    // Select the users's password hash from the database
    $stored = query( 'SELECT * FROM wp_customers WHERE email = ' . $username );

    require_one( 'class-phpass.php' );
    $hasher = new PasswordHash(8, TRUE);

    return $hasher->CheckPassword( $password, $stored );
}

If the password you pass in to the function hashes to the same as the stored value, the function will return true. Otherwise it will return false.

Looking at the comments you left on the other question, it seems like you have some other issues, though. To quote:

So I get:

$P$BqVYujC/jqNY4aylZpHi475jwcaSUs1 But how can I compare that with one in DB?

One in DB is:

fa063a4ed35e092a2d4e15c1b6a61871 How to compare those two with MySQL?

I can tell you right now that the password you're getting from the database was not hashed using the PHPass utility. Those hashes will always resemble the $P$B starting because that's what tells the system how it was hashed. PHPass is based on Blowfish which uses that kind of a prefix on encrypted strings.

Your fa063... hash looks more like a standard MD5 hash ... so if your MD5 hash of the plaintext doesn't match, then I think you might have the wrong password.

To answer your "how to I compare those two with MySQL" question ... you don't. MySQL is the data store ... don't do any business logic or comparison in the data store. Read data out, then use a PHP script to perform your comparison.

C'esttrès simple ..

 <?php
include_once($_SERVER['DOCUMENT_ROOT'].'/wp-includes/class-phpass.php' );

// prepare database connection
$ip_address="localhost";
$user_db="userdb";
$pass_db="passdb";

$conn= mysql_connect($ip_address,$user_db,$pass_db);
mysql_select_db("dbname",$conn);
if (!$conn){
            echo "Could not connect: " . mysql_error();
            exit();
}

// wordpress' username that his password going to compare
$user = 'test';
$user_name = htmlspecialchars($user,ENT_QUOTES);

// plain password to compare
$password = 'tespass';

$hasher = new PasswordHash(8, TRUE);

// get user_name's hashed password from wordpress database
$queryx = "select * from wa1gty5f_users where user_login='$user_name'";
$Resultx = mysql_query($queryx,$conn);

while($row = mysql_fetch_array($Resultx)){
     $passnya = $row[user_pass];
}

// compare plain password with hashed password
if ($hasher->CheckPassword( $password, $passnya )){
    echo "MATCHED";
} else {
    echo "NO MATCHED";
}
?>
 

It's very easy..

<?php
include_once($_SERVER['DOCUMENT_ROOT'].'/wp-includes/class-phpass.php' );

// prepare database connection
$ip_address="localhost";
$user_db="userdb";
$pass_db="passdb";

$conn= mysql_connect($ip_address,$user_db,$pass_db);
mysql_select_db("dbname",$conn);
if (!$conn){
            echo "Could not connect: " . mysql_error();
            exit();
}

// wordpress' username that his password going to compare
$user = 'test';
$user_name = htmlspecialchars($user,ENT_QUOTES);

// plain password to compare
$password = 'tespass';

$hasher = new PasswordHash(8, TRUE);

// get user_name's hashed password from wordpress database
$queryx = "select * from wa1gty5f_users where user_login='$user_name'";
$Resultx = mysql_query($queryx,$conn);

while($row = mysql_fetch_array($Resultx)){
     $passnya = $row[user_pass];
}

// compare plain password with hashed password
if ($hasher->CheckPassword( $password, $passnya )){
    echo "MATCHED";
} else {
    echo "NO MATCHED";
}
?>

J'aieu ceproblèmeet je l'ai découvert directement sur wp_hash_password()

Comparez unmot depasse déjà haché avec sa chaîne detextebrut

 <?php

$wp_hasher = new PasswordHash(8, TRUE);

$password_hashed = '$P$B55D6LjfHDkINU5wF.v2BuuzO0/XPk/';
$plain_password = 'test';

if($wp_hasher->CheckPassword($plain_password, $password_hashed)) {
    echo "YES, Matched";
} else {
    echo "No, Wrong Password";
}

?>
 

I had this problem and found out right on wp_hash_password()

Compare an already hashed password with its plain-text string

<?php

$wp_hasher = new PasswordHash(8, TRUE);

$password_hashed = '$P$B55D6LjfHDkINU5wF.v2BuuzO0/XPk/';
$plain_password = 'test';

if($wp_hasher->CheckPassword($plain_password, $password_hashed)) {
    echo "YES, Matched";
} else {
    echo "No, Wrong Password";
}

?>

C'étaitil y aenviron 6 ans,maistoujours d'actualité.Pour référence,jetez un œil à:

• wp_hash_password () dans wp-includes/pluggable.php
• Framework de hachage demot depasse PHPportable
• Queltype de hachage WordPress utilise-t-ilpourmots depasse

It's about 6 years ago, but still actual. For reference, take a look at:

• wp_hash_password() in wp-includes/pluggable.php
• Portable PHP Password hashing framework
• What type of hash does WordPress use for passwords