I need to alter the default D7 message that gets presented to the user on a failed login attempt. I need to give them one message if their username isn't found, and another if their password is wrong. Default Drupal behavior is to give a single, generic error message that doesn't distinguish between the two.

For the password check, The best solution I've found is user_check_password(). This doesn't sit well with me. The password.inc file isn't included in all page requests, and as there are several different context dependent login pages on the site, it isn't always there. I've been forced to require_once it in my custom validation handler which seems very un-drupal-ish.


1 Answer 1


You can set your own custom message according to the validation by adding your custom validation function with login form.

function custom_module_form_alter(&$form, &$form_state, $form_id) {
  if($form_id == 'user_login_block' || $form_id == 'user_login')
    $form['#validate'] = array('custom_module_login_validate', 'user_login_authenticate_validate');
function custom_module_login_validate($form, &$form_state) {
  $uid = _custom_module_is_user_exists($form_state['values']['name']);
  if(!$uid) {
    form_set_error('name','Username not found.');
  else {
    if(!user_authenticate($form_state['values']['name'], $form_state['values']['pass'])) {
       form_set_error('pass','Incorrect password.');

 * Query user table to check if such username is already exists.
function _custom_module_is_user_exists($username) {
  return db_query("SELECT u.uid FROM {users} u WHERE LOWER(u.name) = LOWER(:username)", array(':username'=>$username))->fetchField();

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.