0

I currently have a field named login_count which updates the number of login attempts of a user. How would I get that data and make an if else statement to make the user wait for minutes before he can log in again?

function login_check(){

        if($_SERVER['REQUEST_METHOD']=='POST'){
            include "config.php";
            $conn = mysqli_connect($host,$user,$pass,$db);

            if( mysqli_connect_errno($conn) ){
                echo "Error in DB";
            }else{
                // echo "OK";
            }
            $sql="SELECT * FROM login_details
                    WHERE username='".$_POST['username']."' AND
                    password='".md5($_POST['password'])."'";

            //execute the query
            $result= mysqli_query($conn,$sql);
            //display result            

            if (mysqli_num_rows($result)>0){
                //username and password are correct

                $username= $_POST['username'];
                $_SESSION['username']= $username;

                $qry = "UPDATE login_details SET login_count = 0 WHERE username = '".$_POST['username']."'";
                $rslt = mysqli_query($conn,$qry);

                header("Location: accessnow.php?action=loggedin&username=$username");

            }
            else{
                //username and password are wrong
                // on failed login attempt:

                $query1 = "UPDATE login_details SET login_count = login_count + 1 WHERE username = '".$_POST['username']."'"; 
                $res = mysqli_query($conn,$query1);

                $query2 = "SELECT login_count WHERE username = '".$_POST['username']."'"; 
                $query2_result = mysqli_query($conn,$query2);                   

                if($query2_result >= 3) 
                    { 
                    // SHOULD SHOW AN ALERT
                    echo '<script> alert("You have 3 login attempts")</script>';
                    }                       

                echo '<script> alert("Username and Password did NOT match")</script>'; 

            }
        }
        else{
            //DISPLAY THE LOGIN FORM
        }   

 }
3

2 Answers 2

0

You can make a table to store number of login attempt from a specific IP address. The table structure can be like this,

CREATE TABLE `LoginAttempts` 
(
`IP` VARCHAR( 20 ) NOT NULL ,
`Attempts` INT NOT NULL ,
`LastLogin` DATETIME NOT NULL 
)

Authorization page should work with two tables: one table where information about registered users is stored and the other one where unsuccessful login attempts are listed.

Before verifying entered data, system has to check if the user exceeded attempts limit or not. If in the LoginAttempts table there are more than two records correspondent to one IP address, then error message will appear saying that access is blocked for a certain period of time.

0

It's possibly best to tie it into sessions so that if a certain session makes three failed attempts then deny the session the ability to try and log in. Some ISPs might issue new IPs to their users on every page request (I believe that AOL used to do that). If you do it based on IP address, a hacker might work out after how many attempts they get locked out and adjust their tactics to possibly grab a new IP address after so many attempts

Also be aware that the md5() has generator has been rainbow tabled to death, making it effectively useless. PHP version 5.5 and newer has got functions built in for dealing with the hashing of passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.