Hi. I currently have a website in place that requires a user to login in order to participate. I need to add a security feature that logs the number of times a user fails to login. If the failed login attempts exceeds 5 within a 24 hour period, it locks the user account. When the user account becomes blocked, it redirects to a certain page...let's say (account_locked.php).
How would I approach something like this?
Here is my index.php in case that is needed for any suggestions.
index.php
=============
<?php
require_once('db.php');
include('functions.php');
if(isset($_POST['Login']))
{
if($_POST['username']!='' && $_POST['password']!='')
{
$query = mysql_query('SELECT ID, Username, Active, Level_access FROM users WHERE Username = "'.mysql_real_escape_strin
g($_POST['
username']
).'" AND Password = "'.mysql_real_escape_strin
g(md5($_PO
ST['passwo
rd'])).'"'
);
if(mysql_num_rows($query) == 1)
{
$row = mysql_fetch_assoc($query);
if($row['Active'] == 1)
{
session_start();
$_SESSION['user_id'] = $row['ID'];
$_SESSION['logged_in'] = TRUE;
$_SESSION['Level_access'] = $row['Level_access'];
switch($row['Level_access'
])
{
case 1:
{
header("Location: control_panel.php");
break;
}
case 2:
{
header("Location: control_panel.php");
break;
}
}
}
else {
$error = 'Your user account was not activated. Please open the email that was sent and click on the activation link.';
}
}
else {
header("Location: login_fail.php");
}
}
else {
$error = 'Please enter both your username and password to access your account';
}
}
?>
<?php if(isset($error)){ echo $error;}?>
Start Free Trial
