How to limit login attemps?

[RRosebury]

I'm in the process of making a website, I know the basics of PHP etc.. and have a page where a user has to sign up and activiate thier account via e-mail, when they clikc the link it change a field in the MySQL database from 0 to 1. If it remains 0 the user cannot login in.

What I want to do, is set it up so if the password is wrong say 5 times then this activiation number is updated and changed to 0 again. How would be best to do this? If statement? While loop or what??

I have attached the work in progress of the code and any help would be appreciated ASAP!

<?php
 
    include "dbconnect.php";
    session_start();
       $email =$_POST["email"]; 
       $password =$_POST["password"];
       $password2 = md5("$password"); 
       $activation = 1; 
       $i=0;
        if ($i < 5) 
        {
 
 
 
 
       if (empty($email) or empty($password)) 
           {
           $_SESSION["message"] = "Must enter your E-mail and Password " ;
           header("Location: login.php"); //This sets the redirection information
            //Ends the script and redirects to above
           } 
 
          $query = "SELECT * FROM clients_details WHERE email = '$email' AND  password = '$password2' AND activation = '$activation' ";
          $result = mysql_query($query) or die ("Error in query: $query. ".mysql_error()); 
        // see if any rows were returned 
        if (mysql_num_rows($result) > 0) 
         { 
           $_SESSION["authenticatedUser"] = $email;
             // Relocate to the logged-in page
            header("Location: usercontrol.php");
         } 
        else  
         {
             $i = + 1;
           $_SESSION["message"] = "Could not login as $email " ;
           header("Location: login.php");
 
 
         }
 
        }
        else {
        $query = " UPDATE clients_details SET activation = '0' WHERE email= '$email' ";
            $_SESSION["message"] = "$email your account has been blocked, please contact the systems administrator! " ;
               header("Location: login.php"); 
 }
 
         exit;
?>

[Frinavale]

You may consider adding a time window for the login attempts...for example, 5 minutes or something.

You could use session to keep track of the number of times a user has attempted to log in from a particular browser. Or you could use a hiddenfield (which is client side so this could be reset and probably shouldn't be depended on). Or you could use a cookie (also stored client side)...or you could store this number in the database.....

-Frinny

[RRosebury]

I have a timeout session in place, whcih logs out the user after 600 seconds, but I thought it would be a simple if statement. Stating the password is wrong of the 5th time then update the database, make the activiation code to 0 and therefore blocking the account.

This is some help that has been suggested to me:

Looks like $i will be re-set to 0 each time the script is run.
May need to create a session variable counter and pass it back and forward between the form and script.

Any help would be appreciated

thanks

[Frinavale]

Well, when the user clicks the "login" button, you should authenticate the password. If the password is wrong then increment the variable in session that keeps track of the number of times that that the user has provided an invalid password. If an invalid password has been provided incorrectly 5 times, then preform the necessary steps to deactivate the account. (You need to use if-statements to accomplish this).

-Frinny

[RRosebury]

Would it be possible for you to include some coding for an example please

[Frinavale]

The $_POST is array of variables passed to the current script via the HTTP POST method. If your submit button was clicked then your submit button will be part of the post.


The isset method determines if a variable is set and is not NULL. If the submit is part of the array of variables passed in to the current script, then it will not be null and you know the user clicked your submit button.

if (isset($_POST['Submit'])) {
  //In here check if the user has provided the correct password
  //If the user has not provided the correct password:
  //  grab the Session variable for tracking the number of times 
  //  the user has provided an incorrect password and increment the counter
  // If the user has provided an incorrect password more than 5 times then:
  //  do what is necessary to  deactivate the account
}

[RRosebury]

would this go on the login.php page or loginaction.php page tho?

[Frinavale]

You never mentioned either of these pages....
What is the purpose of each page?
Are they combined? Do you have more than one submit on the same page?

[RRosebury]

Sorry my mistake, login.php takes the user details e-mail and password via a input form and then when the button submit is clicked. The data is posted to loginaction.php the code i posted earlier.

[Frinavale]

Retrieve $i from session instead of setting it to 0.
Before you exit the page be sure to store $i in session so that you can retrieve it next time the page is submitted to check if the user has provided an invalid password more 5 times...