Solved

Show alert after 3 wrong login attempts

Posted on 2011-09-27
5
306 Views
Last Modified: 2012-06-27
So, I'm trying to create an if/else statement that sends a warning to someone who has tried more than 3 invalid login attempts. When someone tries to login it looks to a MySQL db and if a username with that password matches, it forwards them on. But if it’s wrong I want it to begin a count and then at 4 wrong attempts display an error message. So right now, here’s what I have:

On the login page:
<login form>
if ($i>3) {echo “error message”;}

On the check login info page:
if (login is right)
{ assign variables and pass on}
else
{ $i++;}

Any help would be appreciated!
0
Comment
Question by:brendan-amex
  • 2
  • 2
5 Comments
 
LVL 8

Expert Comment

by:Rik-Legger
ID: 36710632
You could do this by using sessions,

session_start();

if ($_SESSION['login_attempts'] > 3) {
    echo  'error message';
    die;
}

if (login is right) {
    // 
} else {
    $_SESSION['login_attempts']++;
}

Open in new window

0
 
LVL 13

Expert Comment

by:Hugh McCurdy
ID: 36710794
Sessions only works if your record the 3 attempts in the database.  Otherwise someone could just close the browser and get 3 more sessions.  A hacker would figure that trick out quickly and just destroy the session variable using software.

What I would do is record the attempts in the database record belonging to the user.

The simple approach is to simply keep a counter in the database record.  Be sure you reset the counter to 0 if the login attempt is successful.  If the counter gets to 3, then lock the account, produce instructions on how to unlock it, etc.

A more complicated approach has the counter but also records the time of each login attempt (successful or not).  You'd keep a history of at least 3 but it could be more, like 10.  This might help if you wanted to investigate further.
0
 

Author Comment

by:brendan-amex
ID: 36710921
I see, recording it in a database makes sense but what if a couple people enter a wrong password at the same time and then it locks out for all of them? Could I grab the IP address from the computer and put that in the database as well to associate with it....
0
 
LVL 13

Accepted Solution

by:
Hugh McCurdy earned 500 total points
ID: 36711001
I guess I wasn't clear.

You want to store the failed attempts in the record (table row) that  is associated with the user attempting to login.

If more than one user is trying to login under the same user name from different locations, you have enough of a problem to justify locking the account right then.

Your idea of IP address is good.  If you know the user is in Detroit and you start getting login attempts from an IP in Armenia, you might want to know about it.
0
 

Author Closing Comment

by:brendan-amex
ID: 36711761
I understand what you're saying now. I have a CAPTCHA come up after 3 wrong attempts from the same IP address. Hopefully this helps against bot attacks. Thanks for your help.
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
converting integer data type to time data type in sql 4 43
HTML5 storage and web apps 11 44
Put POST values into cookies. 14 29
Validating number not work with decimal 4 23
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
Many old projects have bad code, but the budget doesn't exist to rewrite the codebase. You can update this code to be safer by introducing contemporary input validation, sanitation, and safer database queries.
In this tutorial viewers will learn how to style elements, such a divs, with a "drop shadow" effect using the CSS box-shadow property Start with a normal styled element, such as a div.: In the element's style, type the box shadow property: "box-shad…
The viewer will learn the benefit of using external CSS files and the relationship between class and ID selectors. Create your external css file by saving it as style.css then set up your style tags: (CODE) Reference the nav tag and set your prop…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question