I use user_save() to create a new user in a custom module. If the function returns TRUE, is it possible to auto login the user?


I've done some more searching and found the user_authenticate()

This is the code I have so far:

$user_info = array(
  'name' => $sessdata['username'],
  'pass' => user_password(),
  'mail' => $sessdata['username'],
  'init' => $sessdata['username'],
  'status' => 1,
  'roles' => array(DRUPAL_AUTHENTICATED_RID => TRUE),
                    'access' => time(),
  $save = user_save($account,$user_info);

  if($save) {
    $loggedin = user_authenticate($save->name, $save->pass);

    if($loggedin) {
      echo "logged in";
    } else {
      echo "damn";

Well it saves the user but it doesn't logins him.


Actually, user_save() returns a user object, not TRUE. If it doesn't return FALSE, then the function was successful and you can use the returned object to log in that user.

For example, supposing that $user is the user object returned from user_save(), you can use the following code to replace the currently logged in user with that user (the code is for Drupal 7).

$original_user = $GLOBALS['user'];
$GLOBALS['user'] = $user;

// Do what you need.

$GLOBALS['user'] = $original_user;

The code can be used to do some actions impersonating another user, or when a user follows a link reported him in an email, which allows the user to log in. In the latter case, the last two lines should be removed from the code executed.

Without setting the value of $GLOBAL['user'], there isn't any way to let Drupal think a user is logged in.

user_authenticate() is not working because you are not passing the password for that account. In fact, Drupal doesn't save the password in any places; it saves the hash of the password, but that is not what user_authenticate() needs, as reported from its documentation page:


$name User name to authenticate.

$password A plain-text password, such as trimmed text from form values.

Return value

The user's uid on success, or FALSE on failure to authenticate.

The function passed its $password parameter to user_check_password(), which execute the following code:

  if (substr($account->pass, 0, 2) == 'U$') {
    // This may be an updated password from user_update_7000(). Such hashes
    // have 'U' added as the first character and need an extra md5().
    $stored_hash = substr($account->pass, 1);
    $password = md5($password);
  else {
    $stored_hash = $account->pass;

  $type = substr($stored_hash, 0, 3);
  switch ($type) {
    case '$S$':
      // A normal Drupal 7 password using sha512.
      $hash = _password_crypt('sha512', $password, $stored_hash);
    case '$H$':
      // phpBB3 uses "$H$" for the same thing as "$P$".
    case '$P$':
      // A phpass password generated using md5.  This is an
      // imported password or from an earlier Drupal version.
      $hash = _password_crypt('md5', $password, $stored_hash);
      return FALSE;
  return ($hash && $stored_hash == $hash);

As you see, $account->pass is used as stored hash of the password, while you are passing that value as password.

  • Thank you! Your answer clears a lot! This code works if I am already logged in and then indeed it changes the logged in user, but not when no one is logged in. I need to be able to log in to a drupal site, by visiting a link from a different site to a custom module I am building.
    – chchrist
    Jan 11 '12 at 16:50
  • 1
    I've added to your code this: $form_state = array(); $form_state['uid'] = $user->uid; user_login_submit(array(), $form_state); and now it works!
    – chchrist
    Jan 12 '12 at 8:44

To login a user do

global $user;
$user = $save;
  • Will that work with register_globals_off ?
    – chchrist
    Jan 11 '12 at 15:25
  • It works, but after I set the $user = $save , I use drupal_goto() and the access is denied..
    – chchrist
    Jan 11 '12 at 16:16
  • DO I need to enter an entry to the sessions table, somehow?
    – chchrist
    Jan 11 '12 at 16:18

The function you're looking for is user_login_finalize. This takes the current value of $GLOBALS['user'] and sets that user as the logged in user.

To create and log in a user, try the following:

// Operate on the global $user variable so it is available to
// user_login_finalize() when called.
global $user;

// Create a user. The password is set to a random 10-digit
// as generated by user_password().
$user_info = array(
  'name' => 'USERNAME',
  'pass' => user_password(),
  'roles' => array(
  'mail' => 'E-MAIL ADDRESS',
  'init' => 'E-MAIL ADDRESS',
  'status' => 1,
  'access' => REQUEST_TIME,
  'timezone' => NULL,

// Add the 'ROLE_NAME' role
$rid = array_search('ROLE_NAME', user_roles());
$user_info['roles'][$rid] = TRUE;

// Set a value for FIELD_NAME
$user_info['FIELD_NAME'][LANGUAGE_NONE][0] = array('value' => '…');

// Set the $GLOBALS['user'] to the newly created user account
$user = user_save(NULL, $user_info);

// Finalize user login (modify $_SESSION, set login time in db)

Just add following code in validation function:

$form_state['uid'] = user_authenticate($form_state['values']['name'], $form_state['values']['pass']);

Submit function (user_login_submit) will automatically log in user.


none of the above worked for me

instead i did the following:

  $uid = user_authenticate($username , $password); 
  // do not need to hash the password
  $user = user_load($uid);
  $form_state = array();
  $form_state['uid'] = $uid;
  user_login_submit(array(), $form_state);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.