Logging into Drupal from an external application
You can use the form API to write a custom function for validating authentication. Something like this (this is from Drupal 7, but for 6 you have the same logic and the API is not very different). The code here is from a module I've wrote to authenticate users from an IP.Board (a forum software) database:

&lt;?php
/**
 * @file
 * Allow Drupal 7 to use IP.Board members table for authentication
 *
 * Some code is based on this nice tutorial http://www.touchnoc.com/node/86
 */

/**
 * Alter the user login block form
 */
function ipbridge_form_user_login_block_alter(&amp;$form, &amp;$form_state) {
  _ipbridge_user_login_form_alter($form, $form_state);
}

/**
 * Alter the user login page
 */
function ipbridge_form_user_login_alter(&amp;$form, &amp;$form_state) {
  _ipbridge_user_login_form_alter($form, $form_state);
}

/**
 * Change the validate callback
 */
function _ipbridge_user_login_form_alter(&amp;$form, &amp;$form_state) {
  $k = array_search('user_login_authenticate_validate', $form['#validate']);
  $form['#validate'][$k] = 'ipbridge_authenticate_validate';
}


/**
 * Custom validation
 */
function ipbridge_authenticate_validate($form, &amp;$form_state) {

  // try normal validation first
  user_login_authenticate_validate($form, $form_state);
  if ($form_state['uid'] !== FALSE)
    return;

  // still here? Try to find the user in IP.Board
  $name = $form_state['values']['name'];
  $pass = $form_state['values']['pass'];

  $records = db_select('ibf_members', 'u', array('target' =&gt; 'ipb'))
  -&gt;fields('u', array('member_id', 'name', 'members_pass_hash', 'members_pass_salt', 'email'))
  -&gt;condition('u.name', $name, '=')
  -&gt;execute();

  if ($records-&gt;rowCount() == 1) {

    $ipbUser = $records-&gt;fetchObject();

    // this is how IPB generates the pasword hash
    $hash = md5(md5($ipbUser-&gt;members_pass_salt) . md5($pass));

    if ($hash == $ipbUser-&gt;members_pass_hash) {

      // based on Drupal's user_external_login_register (that function doesn't set the email address)
      $account = user_external_load($name);
      if (!$account) {

        $userinfo = array(
          'name' =&gt; $name,
          'mail' =&gt; $ipbUser-&gt;email,
          'pass' =&gt; user_password(),
          'init' =&gt; $name,
          'status' =&gt; 1,
          'access' =&gt; REQUEST_TIME,
        );

        try {
          $account = user_save(drupal_anonymous_user(), $userinfo);
        } catch (Exception $e) {
          drupal_set_message(t('Are you trying to login using an IP.Board username that was previously registered in Drupal? Caught exception: ' . $e-&gt;getMessage()), 'error');
        }

        if (!$account) {
          drupal_set_message(t("Error saving IPB account."), 'error');
          $form_state['uid'] = FALSE;
          return;
        }
        user_set_authmaps($account, array("authname_ipbridge" =&gt; $name));
      }

      $form_state['uid'] = $account-&gt;uid;
    }
  }
}
?&gt;