如何在3次登录尝试后阻止用户？ [关闭]

Question

how to block user after 3 login attempts ?

Here is my code :

session_start();

        /************Connexion************/

    if(isset($_POST['cnx'])){
    require_once('../config.php');
    $db = new DBSTOCK();
    $cnx = $db->connect();
    $user=$_POST['user'];
    $pass=$_POST['pass'];
    // To protect from MySQL injection for Security purpose
    $user = strip_tags($user);
    $pass = strip_tags($pass);

    $user = stripslashes($user);
    $pass = stripslashes($pass);

    $user = mysqli_real_escape_string($cnx,$user);
    $pass = mysqli_real_escape_string($cnx,$pass);

    $q=mysqli_query($cnx,"select * from admin where user='".$user."'");

    $row = mysqli_fetch_array($q); //or die(mysqli_error($con));
    $pw = $row['pass'];//hashed password in database
    $username = $row['user'];


    if($user==$username && password_verify($pass, $pw)) {
    $_SESSION["user"]=$user;
    header("Location: ../view/accueil.php");
    }
    else{
    header("Location: ../index.php?failed=0");
    }}


        /************Deconnexion************/

         if(isset($_GET['decnx'])){

         session_destroy();
         session_unset();

         header("Location: ../index.php");
    }

any script suggestion i can add to my code so a user can be blocked for 10 minutes after 3 consecutive failed login attempts ?

Answer 1

Add the following two columns to your row:

• last_attempt as a datetime
• attempt_count as an int

In your login logic, check these two values, if it's 3 or more and within the time frame (ex: 10mins), then update last_attempt and increment attempt_count, this second part is not necessary but you might want to know this. If it's been more than 10mins, then set attempt_count back to 0 if they pass or 1 if they fail and update last_attempt again.

As a bonus, you now also know the last time the user logged in, which is useful when you want to find unused accounts.