but then this validation functions in HEAD are used the false way too:

* contact_mail_page_validate() [1] * user_pass_validate [2] - who is using this? and why does it have no arguments?

cu tobi [1] http://drupaldocs.org/api/head/function/contact_mail_page_validate [2] http://drupaldocs.org/api/head/function/user_pass_validate

Form API and the conversion of core to it is not Pallas Athene to sprang fully grown and armed. No. The form API was a fantastic achievement by Adrian which was refined further during the conversion. Some parts of the core are 'ancient', like their theme function do not use element_children to iterate through the form and so on. On the other hand, we need a 4.7 out of the door so these WILL NOT be fixed. In 4.8, I will kill global $form_values, rest assured. And if I have my own way, do away with all other globals, but that's a whole another story. Regards NK