- I have the following loginsystem, following mmtuts on youtube and I am trying to add a login failed attempt system.
- If the user has logged in 5 times and failed, they can't login anymore for at least 10 mins but I found it hard to modify his code.
- . I have a feeling that it could be the line where he has if ($row = mysqli_fetch_assoc($result) {};
- Does this mean if $row exists? Shouldn't he done a num_row here? Whenever I tried to modify his code, the login.php page will just hang or freeze with a white border and no css displayed....
<?php if (!isset($_POST['submit'])) { header("Location: ../index.php?login=error"); exit(); } else { include_once 'dbh.php'; include_once '../header2.php'; $uid = $_POST['uid']; $pwd = $_POST['password']; date_default_timezone_set("Australia/Melbourne"); $date = date("Y-m-d H:i:s");
$sql = "UPDATE users SET user_session = ? WHERE user_uid = ?;"; $stmt = mysqli_stmt_init($conn) //Prepare the prepared statement if (!mysqli_stmt_prepare($stmt, $sql)) { echo 'SQL statement failed'; } else {//Bind parameters to the placeholder mysqli_stmt_bind_param($stmt, "ss", $date, $_SESSION['u_uid']); //Run parameters inside database mysqli_stmt_execute($stmt);// include error handlers: // Check to see if the inputs are empty //Check to see if user has activated his or her account before logging in $user_activate = 0; if(empty($uid) || empty($pwd)) { echo ""; exit(); } else {
// Check to see if user has activated his or her account $sql = "SELECT * FROM users WHERE user_activate = ? AND user_uid= ?;"; $stmt = mysqli_stmt_init($conn); //Prepare the prepared statement if (!mysqli_stmt_prepare($stmt, $sql)) { echo 'SQL statement failed'; } else { //Bind parameters to the placeholder mysqli_stmt_bind_param($stmt, "is", $user_activate, $uid); //Run parameters inside database mysqli_stmt_execute($stmt); $result = mysqli_stmt_get_result($stmt); $resultCheck = mysqli_num_rows($result); if($resultCheck > 0) { echo "<meta http-equiv='refresh' content='0;url=../signup.php?signup=notactivated'>"; exit(); } else { // Check to see if the username exists in the database $sql = "SELECT * FROM users WHERE user_uid = ? OR user_email = ?"; $stmt = mysqli_stmt_init($conn); //Prepare the prepared statement if (!mysqli_stmt_prepare($stmt, $sql)) { echo 'SQL statement failed'; } else { //Bind parameters to the placeholder mysqli_stmt_bind_param($stmt, "ss", $uid, $uid); //Run parameters inside database mysqli_stmt_execute($stmt); $result = mysqli_stmt_get_result($stmt); $resultCheck = mysqli_num_rows($result); if ($resultCheck < 1) { echo "<meta http-equiv='refresh' content='0;url=../index.php?login=notsignup'>"; exit(); } else { // Does the password match the password in the database? // while($row = mysqli_fetch_assoc($result)); if ($row = mysqli_fetch_assoc($result)) { // insert database results into an array // De-hasing the password $date = strip_tags(date('Y-m-d H:i:s', strtotime("+5 minutes"))); $login_attempts += 1; $sql2 = "UPDATE users SET login_attempts = ?, login_failed_delay = ? WHERE user_uid = ? "; if (!mysqli_stmt_prepare($stmt, $sql2)) { echo 'SQL statement failed'; } else { //Bind parameters to the placeholder mysqli_stmt_bind_param($stmt, "iss", $login_attempts, $date, $uid); //Run parameters inside database mysqli_stmt_execute($stmt); $hashedPwdCheck = password_verify($pwd, $row['user_password']); if ($hashedPwdCheck == false && $date < $row['login_failed_delay']) { echo "<meta http-equiv='refresh' content='0;url=../login_attempt.php?login=passwordfailed&id=".$uid."''>"; exit(); } elseif ($hashedPwdCheck == true && $date > $row['login_failed_delay']){ // Log in the user here $_SESSION['u_id'] = $row['user_id']; $_SESSION['u_first'] = $row['user_first']; $_SESSION['u_last'] = $row['user_last']; $_SESSION['u_email'] = $row['user_email']; $_SESSION['u_uid'] = $row['user_uid']; $_SESSION['u_permission'] = $row['admin']; $_SESSION['u_session'] = $row['user_session']; $_SESSION['freelesson'] = $row['freelesson']; $_SESSION['datejoined'] = $row['datejoined']; $_SESSION['premium'] = $row['premium']; // Insert into reward points when login // Select names from rewards $sql2 = "SELECT * FROM rewards WHERE user_uid = ?;"; $stmt = mysqli_stmt_init($conn); //Prepare the prepared statement if (!mysqli_stmt_prepare($stmt, $sql2)) { echo 'SQL statement failed'; } else { //Bind parameters to the placeholder mysqli_stmt_bind_param($stmt, "s", $uid); //Run parameters inside database mysqli_stmt_execute($stmt); $result2 = mysqli_stmt_get_result($stmt); $resultCheck2 = mysqli_num_rows($result2); while ($row2 = mysqli_fetch_assoc($result2)) { $_SESSION['u_reward_points'] = $row2['reward_points']; $points = 100; $_SESSION['u_reward_points'] += $points; $sql = "UPDATE rewards SET reward_points = ? WHERE user_uid = ?; "; $stmt = mysqli_stmt_init($conn); //Prepare the prepared statement if (!mysqli_stmt_prepare($stmt, $sql)) { echo 'SQL statement failed'; } else { //Bind parameters to the placeholder mysqli_stmt_bind_param($stmt, "is", $_SESSION['u_reward_points'], $_SESSION['u_uid']); //Run parameters inside database mysqli_stmt_execute($stmt); echo "<meta http-equiv='refresh' content='0;URL=../header2.php?login=success' />" ; exit(); } } } } } } } } } } } } }
I get the following output on the screen:
[![enter image description here][1]]