I'm working on drupal 7, i'm looking for developing customize user log-in module into my site. but facing a problem in that, when we are submit log-in page then password doesn't match with DB password. because drupal not using MD5 encryption method for storing password into it.

So what would be the batter solution for it? how can i achieve my task without fail.? Please help me, its appreciate.


  • How are you customizing your user log-in? Is it just a new look? It is hard to know without knowing what your module is doing, or planning to do. Is your module just changing the theme? The form(s)? Or are you trying to completely implement a new login mechanism from scratch and trying to integrate it with Drupal?
    – user785179
    Commented Jan 24, 2012 at 4:46
  • yes exactly.i'm trying to implement it from the scratch..
    – Chandresh
    Commented Jan 24, 2012 at 4:50
  • is it possible to customize in existing module for different use?
    – Chandresh
    Commented Jan 24, 2012 at 4:51
  • Take a look at the Drupal 7 core module called user.module. It is located in your drupal directory under modules/user. Check out line 2182. There is a function called function user_authenticate($name, $password). That should point you in the right direction, I think.
    – user785179
    Commented Jan 24, 2012 at 4:53
  • 3
    Bad idea to change user.module. Create another module instead. Why do you need to re-write authentication from scratch?
    – paul-m
    Commented Jan 24, 2012 at 6:30

3 Answers 3


You can tweak the existing user login form by implementing hook_form_alter or one of its friends (see link). It allows you to add your own password validation functions.

If you don't know which form ID to use, you can add this code to a custom module to get all used form ids printed out:

mymodule_form_alter(&$form, &$form_state, $form_id) {

You need the Devel module, and appropriate permissions to see the output of dpm().

But there's more. You have to think about password changes, password retrieval, account creation, etc. To let users log in (with your own password check) you need to have a valid Drupal user account for every user. It's not enough to just validate the password against your own database. A possibility would be creating the user accounts in the background once the password check was positive.

A completely different approach: Import your existing users into the Drupal users table, and let them know they have to go through password retrieval.


Drupal 7 doesn't store the MD5, but the password's hash.

You can compare the passwords pretty easily: Use user_hash_password() to get the corresponding hash of the entered password. The function is found inside includes/password.inc.

You can do the comparison in a custom module through a validation handler for the user login form.

  • 1
    The first sentence doesn't make sense.
    – Letharion
    Commented Dec 13, 2012 at 12:51

To compare the passwords you could try user_check_password().

Check whether a plain text password matches a stored hashed password.


$password: A plain-text password

$account: A user object with at least the fields from the {users} table.

Return value


See also Secure password hashing functions for user authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.