限制尝试不会记录到数据库中

时间:2015-05-29 18:13:38

标签: php security throttling

您好我正在尝试使用面向对象的php创建登录限制,我已经使用结构化代码成功创建了它但我无法使用面向对象工作到目前为止继承人代码:

public function find_failed_login($email = null) {
        if(!empty($email)) {
            $query = "SELECT * FROM {$this->table} WHERE email = '".$this->db->escape($email)."'";
            return $this->db->query($query);
        }
    }

    public function record_failed_login($email) {

            $count = 1;
            $time = time();

            $failed_login = $this->find_failed_login($email);
            if(!$failed_login) {
                $query = "INSERT INTO {$this->table} (email, count, last_time) VALUES ('".$this->db->escape($email)."', {$count}, {$time})";
                return $this->db->query($query);
            } else {
                $query = "UPDATE {$this->table} SET email = '{$email}', count = count + 1, last_time = {$time}";
                return $this->db->query($query); 
            }

    }

    public function clear_failed_logins($email = null) {
        if(!empty($email)) {
            $failed_login = $this->find_failed_login($email);
            if(isset($failed_login)) {
                $query = "DELETE FROM {$this->table} WHERE email = '".$this->db->escape($email)."'";
                return $this->db->query($query);
            }
        }
    }

    public function throttle_failed_logins($email = null) {
        if(!empty($email)) {

            $throttle_at = 3;
            $delay_in_minutes = 1;
            $delay = 60 * $delay_in_minutes;

            $failed_login = $this->find_failed_login($email);
            if(isset($failed_login)) {  
                while($failed = mysqli_fetch_assoc($failed_login)) {

                    if(isset($failed) && $failed['count'] >= $throttle_at) {
                        $remaining_delay = ($failed['last_time'] + $delay) - time();
                        $remaining_delay_in_minutes = ceil($remaining_delay / 60);
                        return $remaining_delay_in_minutes;
                    } else {
                        return 0;
                    }

                }
            }

        }
    }

在登录页面中,我这样称呼它:

$objLogin = new Login();

if($objForm->isPost('login_email')) {

        $throttle_delay = $objLogin->throttle_failed_logins($objForm->getPost('login_email'));
        if($throttle_delay > 0) {
            $objValid->add2Errors('failed_logins');
        }

当我尝试这个时,我没有得到任何错误或任何事情,就像它是死代码,会感谢一些专业的帮助:)

0 个答案:

没有答案