WordPress如何加密和验证密码的

WordPress加密和验证密码主要使用函数wp_hash_password() 和 wp_check_password()，WordPress使用的是phpass开源的类生成和验证密码的。

wp_hash_password($password) 纯文本加密成密文

function wp_hash_password( $password ) {
  global $wp_hasher;
 
  if ( empty( $wp_hasher ) ) {
    require_once ABSPATH . WPINC . '/class-phpass.php';
    // By default, use the portable hash from phpass.
    $wp_hasher = new PasswordHash( 8, true );
  }
 
  return $wp_hasher->HashPassword( trim( $password ) );
}

wp_check_password($password, $hash, $user_id = '') 纯文本和密文进行比对来验证密码

function wp_check_password( $password, $hash, $user_id = '' ) {
  global $wp_hasher;
 
  if ( empty( $wp_hasher ) ) {
    require_once ABSPATH . WPINC . '/class-phpass.php';
    $wp_hasher = new PasswordHash( 8, true );
  }
 
  $check = $wp_hasher->CheckPassword( $password, $hash );
 
  return apply_filters( 'check_password', $check, $password, $hash, $user_id );
}