ExpressionEngine Docs

Member XML Format

ExpressionEngine utilizes a special XML format for member data:

        <screen_name>Brett Bretterson</screen_name>
        <password type="md5">653132ffd94b986bf2bb806b3c67d190</password>
        <screen_name>Robert Robertson</screen_name>
        <password type="sha1">1b4395b877794a16a7f4db5747380dbaafc7ff18</password>

The XML tags are identical to their database field counterparts from the exp_members table. All fields are allowed except for “unique_id”.

Important: The <member_id> tag will cause the import utility to overwrite any existing members with the same ID. It is generally recommended that you do not use a <member_id> tag, so when transferring users from one system to another, ExpressionEngine can automatically create new unique IDs for each member without overwriting any existing members.

Required Tags

There are a few tags common to every ExpressionEngine member XML file, as follows.

Root Tag

XML documents require a root tag surrounding all of the elements. For the ExpressionEngine member XML format, the required root tag is <members></members>.

Element Tag

Each XML element of your member data must be contained in a <member></member> tag block.

Member Data Tags

There are three required tags to form a valid member element.

Password Tag

The <password> tag has a special attribute, type. This allows you to provide contextual information for the password.



<password type="text">pa55w0id</password>

“text” type passwords are plain text, unencrypted passwords. When importing members from an XML file, ExpressionEngine will automatically encrypt “text” type passwords for you before inserting them into the database. This allows you to keep existing passwords when importing member data from a third party application that does not store encrypted passwords.


<password type="md5">653132ffd94b986bf2bb806b3c67d190</password>

“md5” passwords are those that have been encrypted with an RSA Data Security, Inc. MD5 Message-Digest Algorithm (md5) hash. [RFC1321]


<password type="sha1">1b4395b877794a16a7f4db5747380dbaafc7ff18</password>

“sha1” passwords are those that have been encrypted with a US Secure Hash Algorithm 1 (sha1) hash. [RFC3174]

Note: If you import encrypted passwords of one type and your ExpressionEngine installation was configured with a different type of encryption, the passwords will not work, and users will need to use the “Forgot Password” link to log in.

Available Member Data Tags