Wordpress MD5 Password

Question

I need to insert users into a Wordpress blog via a PHP script or MySQL, and I have a plain text password. I thought I could do something like this:

$query = "INSERT INTO $new_db.wp_users (user_login, user_pass, user_nicename)
select user_email, md5(user_password), user_name from $source_db.users";

But the passwords all look different from what the Wordpress passwords look like now. All the passwords all start with $P$B

From reading it says there is a salt... is there a way to take a password like test123 and turn it into the encrypted password that Wordpress expects?

Solution 1

The most sensible solution would simply be to use the relevant WordPress function (wp_generate_password) itself.

However, if this isn't an option, you could simply extract the wp_generate_password function (it's in /wp-includes/pluggable.php) and relevant support functions.

Solution 2

Wordpress uses phpass hashing, which is different from MD5.

Solution 3

The easiest way to create the password is ...

1. to use any rubbish as entry in the MySQL table for user_pass, but a correct email.
2. Use the "forgot password" function in the login panel to generate a correct password (or activate this link automatically to notify the user).

Don't forget to copy a "wp_capabilities" and a "wp_user_level" from another account.

Comments

[Ivan]

From the wp-includes/class-phpass.php file: # We're kind of forced to use MD5 here since it's the only # cryptographic primitive available in all versions of PHP # currently in use. To implement our own low-level crypto # in PHP would result in much worse performance and # consequently in lower iteration counts and hashes that are # quicker to crack (by non-PHP code).

[hakre]

This sounds more a comment (to one of the historic answers or the question) than a necro-bumping answer - but most not. just my 2 cents.

[TRiG]

The OP knows how to create MD5 hashed passwords, but is concerned that they won't work because they don't look like WordPress passwords usually look. I am assuring him that they will work. I think that this answers their question. (On which answer did you think I was trying to comment?)

[hakre]

When as comment, then perhaps for the accepted answer, so to hint MD5 still works (or even below the OP directly). And thanks for the OPsplaining, helped to see your reception laid out. Thanks for that, really appreceated. I personally really was more concerned about the time when this was asked, so just in case that was not so clear.