I want someone to help me with this problem : blocking access to the database after three successful login attempts in php/mysql

Do you want to block the computer's access to your database or you want to block the user after three failed attempts??

If you want to block the computer:
1: Get the ip of the system
2: Store the ip in an ip table
3: The ip table should have a row for number of access time
4: Increment the number of access time if the the computer enters a wrong detail
5: If the number of access time is more than 3 do something.
(I don't see why you would want to do this)

If you want to block the user, I am assuming that the username is correct but the password is wrong
1: The user table should have a row for number of access time
2: Increment the number of access time if the the computer enters a wrong detail
3: If the number of access time is more than 3 do something.
(I don't also see why you'd do this because any body could have anybody's username and try to enter it three times)

bearnana:
Do you want to block the computer's access to your database or you want to block the user after three failed attempts??

If you want to block the computer:
1: Get the ip of the system
2: Store the ip in an ip table
3: The ip table should have a row for number of access time
4: Increment the number of access time if the the computer enters a wrong detail
5: If the number of access time is more than 3 do something.
(I don't see why you would want to do this)

If you want to block the user, I am assuming that the username is correct but the password is wrong
1: The user table should have a row for number of access time
2: Increment the number of access time if the the computer enters a wrong detail
3: If the number of access time is more than 3 do something.
(I don't also see why you'd do this because any body could have anybody's username and try to enter it three times)

I love it when I ses women in these field.

You seem to know whAt you are doing (that's if you didn't do Copy & Paste).

As for OP, Never block a user by IP because anyone can be on an IP and anyone can change their IP in less than 1 second.

Block the user by their Unique details such as user_name, email, etc and when you do, please alwAys make it temporary with a link to their email giving them options on how to unlock it ELSE just let ir auto expire after X seconds.


I Don't recommend IP blocking except in certain situations. This is to avoid blocking Legitir Users.

bassdow:



I love it when I ses women in these field.

You seem to know whAt you are doing (that's if you didn't do Copy & Paste).

Women are not so much in tech, thats true. But I feel the comment about copying and pasting is very inappropriate...

bearnana:


Women are not so much in tech, thats true. But I feel the comment about copying and pasting is very inappropriate...

You seem to know whAt you are doing (that's if you didn't do Copy & Paste).

Hello dear, take a Look at the Bolder Clause. Never said you did or didn't. Just don't wanna throw a Credit unnecessarily.
Well my apologies anyways

No one gives ideas to idiots that try to use bogus inoranotical floligolistic words instead of simple words to ask their illop lagalofobalolistic questions

I don't think you are bereft of ideas in as much as you really don't know what you are doing.

As a precondition for responding to your questions you should have provided more background information on how your application works.

Does it manage data access at a database or application layer?

It is recommended you handle the data access restrictions at the application layer because handling it st the database layer could open your database to all sorts of vulnerabilities. You would need to create a new user at the database layer for each user on your application. This is madness and I hope this is not what you are doing. If it is, please change it.

Handling it at the application layer is just so much cleaner. You create a table with user login attempts and every time a user attempts to log in you check if they have been similar failed attempts in the last 30 minutes for example. Doing this also ensures that after 30 minutes the user should be able to login again.

I hope this helps.

DIGITAL MARKETING EBOOKS AND VIDEOS

Learn Google Adwords, Email Marketing, Search Engine Optimization, Facebook Ads and other Social Media Marketing etc...

These DIGITAL MARKETING COURSE is packaged and organized to teach you everything you need to know. So it is a practical oriented training ebooks and videos geared toward showing you how to use the online media for marketing purpose.

Visit www.dmf.legalwebconsult.com