Am I reading this right? If the user types in a bad username, you tell them. If the user types in a valid username but bad password, you tell them that as well. I've always been taught that doing so was a security risk. Try using a more generalized "Bad username and/or password".