Question

I created a script outside of Joomla that can successfully generate a Joomla password:

// I copied the JUserHelper class from Joomla here
$salt = JUserHelper::genRandomPassword(32);
$crypt = JUserHelper::getCryptedPassword($password, $salt);
$psw = $crypt.':'.$salt;

My question is, how can I compare this new crypt:salt I generate above to a password of an existing user in the Joomla database, and know if the password supplied to the script above is the correct password for that user in the database?

Answer 1

One way would be to query the Joomla database directly to get a user’s (salted and hashed) password, then compare. I think the below query should work for that, based on what I have seen from a few google searches. I have done this in WordPress, so I’m assuming Joomla would be similar.

select 'password' from `jos_users` WHERE `username` = "Bob";