attempting to restrict login attempts

Davidc316

Yes, it is.

I have to say though... I think I may be on the verge of solving this one.

Since last night I've been reading up on sessions and I think they hold the key. I'm just playing around with the script right now to see what happens.

mystrymaster

is this the page that also has the login form on it?

Davidc316

(Before I even start I just want to say that I have checked the PHP manual, two separate PHP books one magazine and this forum regarding my problem and have not found a satisfactory answer)

Hi,
this is quite a simple problem, but it's got me stumped.

I'm trying to give a user 5 attempts to enter a username and password.

A portion of the script that I've created is as follows;

PHP:

//if the user has entered a valid username and password...

print "Welcome $fname $lname. Your email address is $email. Your password is $password. You are now logged on!";

} else {
$trys=1;
while ($trys<=5) {
$allowed=5;
echo "You failed to enter a valid username and password. Please try again.<br>";
$trys++;
//then it draws up a form and lets the user try again.

  if ($trys>$allowed) { 
    print "You have had used up your five attempts.  Hit the bricks!"; 
}

As you can imagine... that doesn't work. It just prints the "try again" message four times then prints the "hit the bricks" message at the bottom. It then draws up the form, but filling it out and sending it makes no difference to the output.

Last edited by Davidc316 on 07-15-2003 at 01:02 AM

jcantrell

} else {
$trys=1;
while ($trys<=5) {
$allowed=5;
echo "You failed to enter a valid username and password. Please try again.<br>";
$trys++;
//then it draws up a form and lets the user try again.

if ($trys>$allowed) {
print "You have had used up your five attempts. Hit the bricks!";
}

What about using an if statement?


} else {
     $allowed=5;
     if ($trys<=5) { 
     echo "You failed to enter a valid username and password. Please try again.<br>"; 
     $trys++; 
     //Show login form again.
      }
 elseif ($trys>$allowed) { 
     print "You have had used up your five attempts. Hit the bricks!"; 
 }
}

This is pretty much exactly what you have, only with the if statement.

You will probably have to use a session variable to store the try variable between attempts.

Another option would be to set up a database table, that would store the user's ip address, and a timestamp, and count how many rows are in the database for that ip address. You could set it to delete any rows in the database with a timestamp of more than 20 minutes, and that would block that person from trying to log in again for 20 minutes.

If it were me doing it, I would probably take the database route.

Let me know if this helps any.

JAKE

Davidc316

Thanks Jake.

Since my first post, I've done a lot of reading and I am now 100% convinced that the best way to do this is through the use of session variables. The idea is that you simply use the variables to keep a note of the number of attempts- as I'm sure you already knew.

I think a database would just result in the build up of lots of redundant database information every time somebody came along and tried to log onto the site.

But let me just say, I haven't tried it yet, but I'm sure your IF section will do the job just fine.

Thanks again. You're a credit to the forum!

dv6cougar

actually my first thoguht was you could use IP address' and store the attempts either in a small database(that's how i would do it) or a cookie

so maybe something like this:

//get userip
$userip = $REMOTE_ADDR;
if($getcookie = $_COOKIE['attempts']) {
$count = $_COOKIE['attempts'];
$count++;
} else {
$count = 0;
}
if($action = setcookie('attempts', '$count', time() + 3600)) {
//cookie was set
} else {
//use mysql or other source becuase Cookie was not set 
}
if($count > 5) {
$usercount = (5 - $_COOKIE['attempts']);
echo "You have $usercount attempts left to login";
} else {
echo "You are no longer allowed to login becuase you have reached
the maximun limit of attempts, please contact the adminstrator for 
fruther deatils.";
}