Question

My client already has a WordPress blog/webshop.
Now she wants an extra system, that requires to login using the same data she uses to login in the WordPress CMS, but outside the system of WordPress.

Getting the username and password from the database is not a problem, but how can I compare the inputted password with the encrypted password from the database?
I know I need to encrypt the inputted password, but what encryption do I need to use, to make sure I can compare those 2 passwords.

Answer 1

WordPress using this function to hash passwords

function wp_hash_password($password) {
        global $wp_hasher;

        if ( empty($wp_hasher) ) {
                require_once( ABSPATH . 'wp-includes/class-phpass.php');

                // By default, use the portable hash from phpass
                $wp_hasher = new PasswordHash(8, TRUE);
        }
        return $wp_hasher->HashPassword($password);
}

You can include wp-includes/class-phpass.php file to your new system or look source make your own function