如何进行登录失败的系统尝试

Question

• 我有以下登录系统，跟踪youtube上的mmtuts，我正在尝试添加登录失败尝试系统。
• 如果用户已登录5次但失败，则至少10分钟内无法再登录，但我发现很难修改他的代码。
• 。我有一种感觉，那可能是他拥有if($ROW=mysqli_fetch_assoc($result){}；
的行
• 这是否意味着$ROW是否存在？他不是应该在这里做一个num_row吗？每当我试图修改他的代码时，login.php页面将只是挂起或冻结，并带有白色边框，且不显示css...

 <?php
if (!isset($_POST['submit'])) {
   header("Location: ../index.php?login=error");
   exit();
} else {
     include_once 'dbh.php';
     include_once '../header2.php';
     $uid =  $_POST['uid'];
     $pwd =  $_POST['password'];

date_default_timezone_set("Australia/Melbourne");
$date = date("Y-m-d H:i:s");

$SQL=“UPDATE USES SET user_session=？WHERE user_uid=？；”；$stmt=mysqli_stmt_init($conn)//准备已准备好的语句if（！mysqli_stmt_prepare($stmt,$sql)){echo“SQL语句失败”；}else{//将参数绑定到占位符mysqli_stmt_bind_param($stmt,“ss”,$date,$_session['u_uid'])；//在数据库mysqli_stmt_execute($stmt)中运行参数；//包括错误处理程序：//检查输入是否为空//检查用户在登录之前是否激活了他或她的帐户$user_activate=0；if（

        // Check to see if user has activated his or her account

        $sql = "SELECT * FROM users WHERE user_activate = ? AND user_uid= ?;";

       $stmt = mysqli_stmt_init($conn);
                            //Prepare the prepared statement
       if (!mysqli_stmt_prepare($stmt, $sql)) {
         echo 'SQL statement failed';
       } else {
       //Bind parameters to the placeholder
      mysqli_stmt_bind_param($stmt, "is", $user_activate, $uid);
      //Run parameters inside database
      mysqli_stmt_execute($stmt);
      $result = mysqli_stmt_get_result($stmt);
      $resultCheck = mysqli_num_rows($result);


    if($resultCheck > 0) {
      echo "<meta http-equiv='refresh' content='0;url=../signup.php?signup=notactivated'>"; 
       exit();
       } else {


        // Check to see if the username exists in the database

        $sql = "SELECT * FROM users WHERE user_uid = ? OR user_email = ?";
        $stmt = mysqli_stmt_init($conn);
       //Prepare the prepared statement
       if (!mysqli_stmt_prepare($stmt, $sql)) {
          echo 'SQL statement failed';
        } else {
      //Bind parameters to the placeholder
      mysqli_stmt_bind_param($stmt, "ss", $uid, $uid);
      //Run parameters inside database
      mysqli_stmt_execute($stmt);
       $result = mysqli_stmt_get_result($stmt);
       $resultCheck = mysqli_num_rows($result);

        if ($resultCheck < 1) {

        echo "<meta http-equiv='refresh' content='0;url=../index.php?login=notsignup'>";
          exit();
        } else {
             // Does the password match the password in the database?
       // while($row = mysqli_fetch_assoc($result));
          if ($row = mysqli_fetch_assoc($result)) { // insert database results into an array
            // De-hasing the password
              $date = strip_tags(date('Y-m-d H:i:s', strtotime("+5 minutes")));
      $login_attempts += 1;

      $sql2 = "UPDATE users
               SET login_attempts = ?, login_failed_delay = ?
               WHERE user_uid = ?

              ";

      if (!mysqli_stmt_prepare($stmt, $sql2)) {
          echo 'SQL statement failed';
        } else {
      //Bind parameters to the placeholder
       mysqli_stmt_bind_param($stmt, "iss", $login_attempts, $date, $uid);
      //Run parameters inside database
      mysqli_stmt_execute($stmt);
            $hashedPwdCheck = password_verify($pwd, $row['user_password']);
            if ($hashedPwdCheck == false && $date < $row['login_failed_delay']) {

               echo "<meta http-equiv='refresh' content='0;url=../login_attempt.php?login=passwordfailed&id=".$uid."''>";
                exit();
            } elseif ($hashedPwdCheck == true && $date > $row['login_failed_delay']){
                   // Log in the user here



              $_SESSION['u_id'] = $row['user_id']; 
              $_SESSION['u_first'] = $row['user_first'];   
              $_SESSION['u_last'] = $row['user_last'];   
              $_SESSION['u_email'] = $row['user_email'];
              $_SESSION['u_uid'] = $row['user_uid'];  
              $_SESSION['u_permission'] = $row['admin'];
              $_SESSION['u_session'] = $row['user_session'];
              $_SESSION['freelesson'] = $row['freelesson']; 
              $_SESSION['datejoined'] = $row['datejoined'];
              $_SESSION['premium'] = $row['premium'];

              // Insert into reward points when login



              // Select names from rewards

              $sql2 = "SELECT * FROM rewards WHERE user_uid = ?;";

              $stmt = mysqli_stmt_init($conn);
       //Prepare the prepared statement
       if (!mysqli_stmt_prepare($stmt, $sql2)) {
          echo 'SQL statement failed';
        } else {
      //Bind parameters to the placeholder
      mysqli_stmt_bind_param($stmt, "s", $uid);
      //Run parameters inside database
      mysqli_stmt_execute($stmt);
       $result2 = mysqli_stmt_get_result($stmt);
       $resultCheck2 = mysqli_num_rows($result2);

       while ($row2 = mysqli_fetch_assoc($result2)) {



              $_SESSION['u_reward_points'] = $row2['reward_points'];

               $points = 100;
              $_SESSION['u_reward_points'] += $points;


              $sql = "UPDATE rewards
                      SET reward_points = ?
                      WHERE user_uid = ?;

                     ";

               $stmt = mysqli_stmt_init($conn);
       //Prepare the prepared statement
       if (!mysqli_stmt_prepare($stmt, $sql)) {
          echo 'SQL statement failed';
        } else {
      //Bind parameters to the placeholder
      mysqli_stmt_bind_param($stmt, "is", $_SESSION['u_reward_points'], $_SESSION['u_uid']);
      //Run parameters inside database
      mysqli_stmt_execute($stmt);


                echo "<meta http-equiv='refresh' content='0;URL=../header2.php?login=success' />" ;  
                exit();

            }

          }
        }

      }

}

}
}
}
}
}
}
}
}

I get the following output on the screen:

[![enter image description here][1]]

Answer 1

创建全局变量$i=0；。然后，对于每个登录错误（每次调用echo“SQL语句失败”；)，执行/add$i++；。并且每次提交表单时，调用stoploginauttempts()；。

记住，这都是客户端代码。不是服务器端！

function stopLoginAttempts() {
    if ($i == 5) {
        echo //echo a script tag that setTimeout(login, 5min);
    }
    elseif ($i == 10) {
        echo //echo a script tag with JS that will call another setTimeout that will stop login attempts for a certain amount of time
    }
}