php - 如何限制登录脚本中的登录尝试次数？

Question

我不知道如何在我的脚本中实现 cookie 代码。下面是我的页面代码:

登录页面:-

<form name="loginform" class="form-horizontal" action="includes/login.php" method="post" onsubmit="return validateloginForm()">

  <div class="form-group">
    <label for="username" class="col-sm-2 control-label">Username</label>
    <div class="col-sm-10">
      <input type="text" class="form-control" name="username" placeholder="Enter the username" id="username">
    </div>
  </div>

  <div class="form-group">
    <label for="password" class="col-sm-2 control-label">Password</label>
    <div class="col-sm-10">
      <input type="password" class="form-control" name="password" placeholder="Password" id="password">
    </div>
  </div>

  <div class="form-group">
    <div class="col-sm-offset-2 col-sm-10">
      <button type="submit" name="signin" class="btn btn-primary">Sign in</button>
    </div>
  </div>
</form>

登录检查

if(isset($_POST['signin'])) {

    $username = $_POST['username'];
    $password = $_POST['password'];

    $username = mysqli_real_escape_string($connection, $username);
    $password = mysqli_real_escape_string($connection, $password);

    $query = "SELECT *FROM users WHERE username = '{$username}'";
    $select_user_query = mysqli_query($connection, $query);

    if(!$select_user_query) {
       die("QUERY FAILED". mysqli_error($connection));
    }
    while ($row = mysqli_fetch_array($select_user_query)) {
        $db_user_id = $row['user_id'];
        $db_username = $row['username'];
        $db_user_password = $row['user_password'];
        $db_user_firstname = $row['user_firstname'];
        $db_user_lastname = $row['user_lastname'];
        $db_user_role = $row['user_role'];
    }
    $password = crypt($password, $db_user_password);

    if ($username !== $db_username && $password !== $db_user_password ){
        header("Location: ../index.php");
    } else if ($username == $db_username && $password == $db_user_password) {
        $_SESSION['username'] = $db_username;
        $_SESSION['firstname'] = $db_user_firstname;
        $_SESSION['lastname'] = $db_user_lastname;
        $_SESSION['user_role'] = $db_user_role;

        header("Location: ../admin"); 
    } else {
        header("Location: ../login.php");
    }
}

我需要将此代码实现到上面的脚本中

if($login_incorrect){
     if(isset($_COOKIE['login'])){
          if($_COOKIE['login'] < 3){
               $attempts = $_COOKIE['login'] + 1;
               setcookie('login', $attempts, time()+60*10); //set the cookie for 10 minutes with the number of attempts stored
          } else{
               echo 'You are banned for 10 minutes. Try again later';
          }
     } else{
          setcookie('login', 1, time()+60*10); //set the cookie for 10 minutes with the initial value of 1
     }
}

先感谢您。我需要将登录限制为 3 次尝试，然后禁止它们 10 分钟。

Answer 1

Cookie 不是一种可靠的方法。
我可以创建一个脚本，在请求中发送我想要的任何 cookie。
我会使用 mySQL

$ip = $_SERVER["REMOTE_ADDR"];
mysqli_query($connection, "INSERT INTO `ip` (`address` ,`timestamp`)VALUES ('$ip',CURRENT_TIMESTAMP)");
$result = mysqli_query($connection, "SELECT COUNT(*) FROM `ip` WHERE `address` LIKE '$ip' AND `timestamp` > (now() - interval 10 minute)");
$count = mysqli_fetch_array($result, MYSQLI_NUM);

if($count[0] > 3){
  echo "Your are allowed 3 attempts in 10 minutes";
}

加载页面后，添加查询以删除任何超过 10 分钟的记录。

ip表:

CREATE TABLE IF NOT EXISTS `ip` (
  `address` char(16) COLLATE utf8_bin NOT NULL,
  `timestamp` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_bin;

您应该为 mysqli_real_escape_string() 设置字符集

mysqli_set_charset($connection, "utf8")

而不是使用重定向导致额外的 routnd trip http 请求，

header("Location: ../login.php");

使用更快的包括:

include("../login.php");

进行重定向时，您应该使用完整路径:

header("Location: http://example.com/login.php");

我不喜欢使用“SELECT *”，当查询中返回不需要的数据时，这是一种资源浪费。在大多数查询中，返回数据的时间占用了大部分查询时间。

我个人对检索字段值的偏好:

SELECT `user_id`,`username`,`user_password`,`user_firstname`,`user_lastname`,`user_role` FROM users WHERE ...


while (list($db_user_id,$db_username,$db_user_password,$db_user_firstname,$db_user_lastname,$db_user_role ) = mysqli_fetch_array($select_user_query, MYSQLI_NUM)) {