The 'logic' here should be that each person should know his or her password
and no-other. If the name-password combination is wrong don't give the users
"mastermind" type clues about which bit was good and bad..

If the combination is bad, just say "username or password incorrect"

Hi Joanne,

Although it might be user friendly to tell the user if it was the name or  
the password is incorrect it isn't very secure and it is not adviced.

If you don't need a secure setup you could easily check if the password is  
correct for a given user (depending on how you store usernames/passwords),  
but for unknown username you would need to check each password in turn.  
Bear in mind that if the user is allowed to set his/her own password you  
might end up with two users having the same password, although it looks  
like you are specifying the passwords yourself.

It is easy enough to manage, but how to do it depends on how you  
store/lookup usernames/passwords.

The Logic is like this:

   if username correct then
       if password correct then
           successfull login
           exit
       else
           wrong password
       end if
   else
       wrong username
   end if