0

If I only have phpMyAdmin as a means of changing a password - e.g. say I can't login and need to change the Admin password (and Drush is equally not available etc) should I be able to reset a user's password using the following query:

UPDATE drupal_users SET pass = SHA2( 'the_password', 256 ) WHERE uid = 20

where the drupal tables are prefixed with "drupal_"

I have tried the above query in order to change the password for a user, but when using the password specified in the above sql statement I am still unable to login. This makes me think I am missing something here.

Anyone got any ideas how to change a drupal 7 user password via PhpMyAdmin using SQL?

2

Drupal 7 uses a hash salt (see your settings.php) in addition to several other bit of information in order to create a SHA2 of the users PW. You should really use drush to change a user's pw if you need to.

  • quote from the question: Drush is equally not available" ... – Pierre.Vriens Dec 18 '17 at 17:26
1

If you have some other Drupal user account access to the site with enough rights, you can generate new hash as follows: Create any content page with PHP text format and put there:

<?php
require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
print('Hash: ' . user_hash_password('my_password'));
?>

Otherwise, if we don't have any Drupal user access or file access I am afraid we are in trouble, because the hash salt is stored in the config file.

  • If you’re bootstrapped far enough to use variable_get wouldn’t you just update the relevant user entity at this point too? Otherwise it’s still a manual job to get it into the database – Clive Dec 18 '17 at 17:54
  • You are right, but, as far as I understand, we've got phpMyAdmin, so I wouldn't bother to write the code for DB update risking to mess up the user table. – Kirill Shabunov Dec 18 '17 at 19:18
  • I meant with user_load/user_save. Manipulating entity data directly is not a smart move unless you really know what you’re doing and what the risks are – Clive Dec 18 '17 at 19:22
  • That would definitely be an option, I agree. But, anyway, the main question is if we have any other access besides phpMyAdmin. – Kirill Shabunov Dec 18 '17 at 19:26
  • Agreed. I think "don't do that, use the API instead" is a valid response though, even if we don't know for sure the OP has other means of access. Try to save people from themselves and all that... – Clive Dec 18 '17 at 19:48
0

If you have a local version with the same setting.php / salt hash, you can use the password-hash script. This will generate a new hashed password that can be inserted via SQL.

All this is explained in the docs.

0

You can generate the query here & run the query in your database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.