记录三次失败的登录尝试

Question

I need a script for logging login attempts: if a user attempts to login 3 times with the wrong password, then script will alert user to log in another way.

I tried this way but it's not working. How should I make this work? An explanation of the implementation of the code would also be appreciated.

public function log($usrname, $password, $type) {

    try {
        $stmt = $this->db->prepare("SELECT * FROM $table WHERE username=:username and password =:password and type=:type");
        $stmt->execute(array(':username' => $usrname, ':password' => $password, ':type' => $type));
        $userRow = $stmt->fetch(PDO::FETCH_ASSOC);
        if ($stmt->rowCount()== 1) {
            echo "loged in";
            } else if($stmt->rowCount == 0){
                $ec = 0;

                $error = ++$ec;
                if(count($error)== 3){
                    echo "you provide wrong username and password 3 times";
                }
            }
        }
    } catch (PDOException $e) {
        $e->getMessage();
    }
}

Answer 1

You should have a 'attempt' field in the database table and each time you login with a wrong password just update the count into the table field and you can check the attempt count in the error condition. if the login is success just reset the attempt count to 0.

I've provide the code logic here. but I am not tested it. use this logic.

But I suggest you to check the username is registered with your table

 public function log($usrname, $password, $type) {

        try {

            $stmt0 = $this->db->prepare("SELECT username FROM $table WHERE username=:username");                
            $stmt0->execute(array(':username' => $usrname);
            if ($stmt0->rowCount()== 1) {

                  $stmt = $this->db->prepare("SELECT * FROM $table WHERE username=:username and password =:password and type=:type");
                  $stmt->execute(array(':username' => $usrname, ':password' => $password, ':type' => $type));
                  $userRow = $stmt->fetch(PDO::FETCH_ASSOC);
                  if ($stmt->rowCount()== 1) {
                      echo "loged in";
                      // UPDATE THE attempt field to 0 here
                       $stmt2 = $this->db->prepare("UPDATE $table SET attempt=:attepmt WHERE username=:username");
                       $stmt2->execute(array(':username' => $usrname, ':attempt' => 0));

                  }else if($stmt->rowCount == 0){                    
                           // select the attempt field and check this is 3
                          $stmt3 = $this->db->prepare("SELECT attempt FROM $table WHERE username=:username");
                          $stmt3->execute(array(':username' => $usrname));
                          $obj= $stmt3->fetch(PDO::FETCH_OBJ);
                          if($obj->attempt==3){                           
                              echo "you provide wrong username and password 3 times";
                          }
                      $attempt = $obj->attempt+1;
                      $stmt4 = $this->db->prepare("UPDATE $table SET attempt=:attepmt WHERE username=:username");
                      $stmt4->execute(array(':username' => $usrname, ':attempt' => $attempt));


                  }


            }else{
              echo "Username  is not  found in table !";
            }
        } catch (PDOException $e) {
            $e->getMessage();
        }

}