Block user after nth login attempt - PHP

Question

I am working in login such that unsuccessful login attempts are stored a database.

Then, after the 3rd login attempt, login will be disabled for the affected user based on the recorded IP address and/or user account.

Unfortunately, my code is not working as expected; the login attempts is not getting stored into the database, and login is still not disabled for the affected user.

What am I doing wrong and how can I fix it?

Below is my login script:

session_start();

//Get IP address
// code goes here

$loginDate      = date("Y-m-d H:i:s");
$Error          = "";
$successMessage = "";

if (($_REQUEST['captcha'] == $_SESSION['vercode'])) {
    //captcha code goes here

    if (isset($_POST['submit'])) {
        if (!( $_POST['username'] == "" && $_POST['password'] == "")) {
            //submit form codes goes here

            if (filter_var($username, FILTER_VALIDATE_INT)) {
                $con = mysqli_connect("localhost", "root", "", "test");
                $result = mysqli_query($con, "SELECT * FROM Users WHERE username='$username' AND password='$password'");
                $loginAttempt = mysqli_query($con, "SELECT * FROM Logs WHERE username='$username'");
                $data = mysqli_fetch_row($result);

                if (count($data)>0) {
                    $_SESSION['login_user']=$username;
                    mysqli_query($con, "INSERT INTO `test`.`Logs`(`username`, `lastLogin`, `ipAddress`, `captcha`) 
                                VALUES('$username', '$loginDate', '$ipaddress', '$captcha')
                                ON DUPLICATE KEY UPDATE `username` = '$username', `lastLogin` = '$loginDate'");
                    header('Location: privatepage.php');
                } else {
                    $Error ="Invalid Contract Number or Password";
                }
                mysqli_close($con);
            }     else {
                $Error ="Invalid Contract Number";
            }

            if (($data['username'] == $username) || ($data['password'] == $password)) {
                $loginAttempt = mysqli_query($con, "UPDATE Logs SET loginAttempt = 0 WHERE username='$username'");
                mysqli_close($con);
            } else {
                if ($loginAttempt >= 3) {
                    echo 'Sorry your account has been lock out. Please contact the administrator';
                } else {
                    mysqli_query($con, "UPDATE Logs SET loginAttempt = loginAttempt +1 WHERE username= '$username'");
                }
            }
        }
    }
}

I got this errors:

PHP Notice: Undefined variable: loginAttempt on line 62

PHP Warning: mysqli_query(): Couldn't fetch mysqli on line 65

Answer 1

Your $data is only containing number of rows in mysql

 $data = mysqli_num_rows($result);

Consider using mysqli_fetch_row

Answer 2

you are not fetching Logs table data depend on the user. you should add this line right before $data['loginAttempt'] and change this $data['loginAttempt'] to $LoginAttempt

$LoginAttempt = mysqli_query($con, "SELECT loginAttempt FROM Logs WHERE contractNumber='$cnumber'");

So your condition to check attempt request will be like

if($LoginAttempt >= 3){
// Your code goes here
}

Answer 3

You need to get the $loginAttempt before checking if it is lower than 3. Try something like this:

$loginAttempt = mysqli_query($con, "SELECT * FROM Users WHERE contractNumber='$cnumber')->fetch_object()->loginAttempt;

if($loginAttempt >= 3) {
  ...
}