How to Limit a Login Attempt Validation using PHP

Submitted by nurhodelta_17 on Monday, September 6, 2021 - 16:52.

This tutorial tackles on how to create a login attempt validation using PHP. If you want to temporarily block a user from logging in to your site after a 3 or more unsuccessful login, this simple tutorial will teach you how to do that using a PHP session. The attempts validation will only count if the username exists on the database but entered the wrong password.

Getting Started

In order to beautify the presentation of this tutorial, I've used Bootstrap which is included in the downloadable of this tutorial but if you want, you can download Bootstrap using this link.

Create the Database

Open your PHPMyAdmin and create a new databse naming dbase. Then navigate to database SQL Tab and paste the SQL script below.

        CREATE TABLE `users` (
          `id` int(11) NOT NULL,
          `username` varchar(50) NOT NULL,
          `password` varchar(60) NOT NULL
        ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
 
        INSERT INTO `users` (`id`, `username`, `password`) VALUES
        (1, 'nurhodelta', '$2y$10$AP027M5jhULJPIBAUiCa0e0phP1UAQBlKqTLLQZ2.UL44x5DdUwHq');
 
        ALTER TABLE `users`
        ADD PRIMARY KEY (`id`);
 
        ALTER TABLE `users`
        MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=2;

Creating our Login Form

Next, we create our login form by creating a new file, name it as index.php and paste the codes below.

<?php
        session_start();
        //check if can login again
        if(isset($_SESSION['attempt_again'])){
                $now = time();
                if($now >= $_SESSION['attempt_again']){
                        unset($_SESSION['attempt']);
                        unset($_SESSION['attempt_again']);
                }
        }
        
?>
<!DOCTYPE html>
<html>
<head>
        <meta charset="utf-8">
        <title>How to Create a Login Attempt Validation using PHP</title>
        <link rel="stylesheet" type="text/css" href="bootstrap/css/bootstrap.min.css">
</head>
<body>
<div class="container">
        <h1 class="page-header text-center">Login Attempt Validation using PHP</h1>
        <div class="row">
                <div class="col-sm-4 col-sm-offset-4 panel panel-default" style="padding:20px;">
                        <form method="POST" action="login.php">
                                <p class="text-center" style="font-size:25px;"><b>Login</b></p>
                                <hr>
                                <div class="form-group">
                                        <label for="username">Username:</label>
                                        <input type="text" name="username" id="username" class="form-control" placeholder="nurhodelta">
                                </div>
                                <div class="form-group">
                                        <label for="password">Password:</label>
                                        <input type="password" name="password" id="password" class="form-control" placeholder="malynisheart">
                                </div>
                                <button type="submit" name="login" class="btn btn-primary"><span class="glyphicon glyphicon-log-in"></span> Login</button>
                        </form>
                        <?php
                                if(isset($_SESSION['error'])){
                                        ?>
                                        <div class="alert alert-danger text-center" style="margin-top:20px;">
                                                <?php echo $_SESSION['error']; ?>
                                        </div>
                                        <?php
 
                                        unset($_SESSION['error']);
                                }
 
                                if(isset($_SESSION['success'])){
                                        ?>
                                        <div class="alert alert-success text-center" style="margin-top:20px;">
                                                <?php echo $_SESSION['success']; ?>
                                        </div>
                                        <?php
 
                                        unset($_SESSION['success']);
                                }
                        ?>
                </div>
        </div>
</div>
</body>
</html>

Creating our Login Script

Lastly, we create our script that checks the user credential and temporarily disables a user after three unsuccessful login attempt.

Create a new file, name it as login.php and paste the codes below.

<?php
        session_start();
 
        if(isset($_POST['login'])){
                //connection
                $conn = new mysqli('localhost', 'root', '', 'dbase');
 
                //set login attempt if not set
                if(!isset($_SESSION['attempt'])){
                        $_SESSION['attempt'] = 0;
                }
 
                //check if there are 3 attempts already
                if($_SESSION['attempt'] == 3){
                        $_SESSION['error'] = 'Attempt limit reach';
                }
                else{
                        //get the user with the email
                        $sql = "SELECT * FROM users WHERE username = '".$_POST['username']."'";
                        $query = $conn->query($sql);
                        if($query->num_rows > 0){
                                $row = $query->fetch_assoc();
                                //verify password
                                if(password_verify($_POST['password'], $row['password'])){
                                        //action after a successful login
                                        //for now just message a successful login
                                        $_SESSION['success'] = 'Login successful';
                                        //unset our attempt
                                        unset($_SESSION['attempt']);
                                }
                                else{
                                        $_SESSION['error'] = 'Password incorrect';
                                        //this is where we put our 3 attempt limit
                                        $_SESSION['attempt'] += 1;
                                        //set the time to allow login if third attempt is reach
                                        if($_SESSION['attempt'] == 3){
                                                $_SESSION['attempt_again'] = time() + (5*60);
                                                //note 5*60 = 5mins, 60*60 = 1hr, to set to 2hrs change it to 2*60*60
                                        }
                                }
                        }
                        else{
                                $_SESSION['error'] = 'No account with that username';
                        }
 
                }
 
        }
        else{
                $_SESSION['error'] = 'Fill up login form first';
        }
 
        header('location: index.php');
 
?>

That's it! You can now test the code you created on your end. If there's an error occurred, please review your codes and check again my provided source code. You can also download the working source code I created for this tutorial. The download button is located below this tutorial.

That ends this tutorial. I hope this helps you with what you are looking for.

Happy Coding :)

Comments

Nice

Nice! still posting code. I'm always checking your profile to see new stuff.

If it's session based it won't stop brute force

The mechanism of creating limited attempts to log in is (in my believe) created to stop the brute forcing the password. If you made it based on Session then malicious user (or even normal one who knows how to use developer tools) can delete his session and start trying from start. The trick is that he must guess if it's Session based but it's easy to find out if you have Session just from trying to log in. So for me it's not secure enough and you should try to store the information where user can't access it like database or simple temporary file. It can be based on ip of user but this can be changed by proxy or because he changed his location.

So there is no 100% secure option (at least I don't know one) so the best we can do is to make it so hard to get in that the hacker will just give up.

just a question

What if the user deleted the whole session at the browser? Will it still wait for the remaining time if the user has attempted many times on logging in?

Username Pass?

BAD practice

This is totaly BAD and irelevant! Malicious hacker will not use same session but bruteattack with milions of requests/second with always new session... what a bad practice... You need at least IP throttle limit and this will slow down or lock out some IPs really fast.

Add new comment

Add new comment
13232 views