I am trying to catch the inputed password on the user registration page from within the hook_user_presave(). I want to send this password out to an external database for storage. However, when I analyzed the $edit variable, I found that the password field was returning an encrypted password.

Is there any way for me to retrieve the actual password?

  • 3
    IMHO, site admins should not have access to user's passwords in unencrypted form. I can see no use-case that cannot be covered by you saving the encrypted password in the external database. – Free Radical Oct 7 '13 at 16:50
  • the client has an external database which it wants to be totally synced with the drupal database, this is the use case. – user1015214 Oct 7 '13 at 16:59
  • 2
    @user1015214 In that case some sort of replication at the database level might be more appropriate than pushing raw password data around. Just to clear something up here: User passwords are not encrypted, they're one-way hashed with a salt (SHA512 in the default implementation). – Clive Oct 7 '13 at 17:05
  • 3
    @user1015214 Encryption = 2-way, Hash = 1-way. So once you have the hashed password there's no going back (well, short of rainbow tables but that's another story). If you plan to use the same password as part of a login mechanism on the other site, you'll need to reproduce Drupal's hashing functionality there too, and copy both the hash and salt across. That's still not ideal as you're passing the hash and salt around together, which makes cracking a lot easier (still computationally expensive, though). The password stuff is in includes/password.inc, that might be the best place to start – Clive Oct 7 '13 at 17:40
  • 2
    If the client wants the external database to be totally synced with the Drupal database, then it makes absolutely no sense to save the password in clear text. The passwords should be save in the same format as in the Drupal database (i.e. as one-way hashes). (PS: My apologies for using the word "encrypted". Clive is of course right, they're hashed, not encrypted.) – Free Radical Oct 7 '13 at 19:25

It us not advised not to use the user's password as a raw value, however if you still want to access the password field value in unencrypted form than try the following:

 * Implements hook_form_alter().
 * Alters user_register_form.
function MyModule_form_alter(&$form, $form_state, $form_id) {
  // Add the additional validation callback for the user registration form.
  if ($form_id == 'user_register_form') {
    $form['#validate'][] = 'MyModule_user_register_form_validate';

// Callback function for Validation handler of user_register_form.
function MyModule_user_register_form_validate($form, &$form_state) {
  if (isset($form_state['values']['pass'])) {
    // Here you will get the value of password.
    $password = $form_state['values']['pass'];

You would need to modify the form and add another submit handler then use that. Once it's in Drupal it's 100% encrypted.

BUT... you SHOULD NOT be sending peoples passwords to an external database in raw form. You should send the encrypted password if anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.