通过ip限制用户和php中的登录尝试次数

Question

I want to restrict a user by the number of attempts he makes, but I am not sure if to do it with javascript or php..and how exactly. (How do I save data between the same form page request. Is it by using a global variable or is it best by using a session?); Also, how can I ban people by their ip?

Answer 1

Do it by PHP.

Do a MySQL table attemptLog

+------+------+------+
|  id  |  ip  | date |
+------+------+------+

Every time a login attempt fail you add the IP to attemptLog. To log in you need a correct username and password (ofc) AND max ie 10 login attempts the last 24h.

To do that you can run SELECT count(ip) AS loginAttempts FROM attemptLog WHERE ip = $_SERVER['REMOTE_ADDR'] AND date < $today - 24h then check if loginAttempts is more then 10.

Banning

To ban a user you can save their IP and check if it isset, if it is set show "You are banned", else show the normal page.