password_hash('Password123!', PASSWORD_DEFAULT), 'user1' => password_hash('letmein2025', PASSWORD_DEFAULT), ]; // ──────────────────────────────────────────────── // HELPER FUNCTIONS // ──────────────────────────────────────────────── function isLockedOut(): bool { if (!isset($_SESSION['login_attempts'])) { return false; } if ($_SESSION['login_attempts'] < MAX_LOGIN_ATTEMPTS) { return false; } $timeSinceLock = time() - ($_SESSION['lockout_time'] ?? 0); $lockoutSeconds = LOCKOUT_MINUTES * 60; if ($timeSinceLock < $lockoutSeconds) { return true; } // Lockout expired → reset unset($_SESSION['login_attempts']); unset($_SESSION['lockout_time']); return false; } function recordFailedAttempt(): void { if (!isset($_SESSION['login_attempts'])) { $_SESSION['login_attempts'] = 0; } $_SESSION['login_attempts']++; if ($_SESSION['login_attempts'] >= MAX_LOGIN_ATTEMPTS) { $_SESSION['lockout_time'] = time(); } } // ──────────────────────────────────────────────── // PROCESS LOGIN // ──────────────────────────────────────────────── $errors = []; $success = false; if ($_SERVER['REQUEST_METHOD'] === 'POST') { if (isLockedOut()) { $errors[] = "Account temporarily locked due to too many failed attempts. Try again in " . LOCKOUT_MINUTES . " minutes."; } else if (empty($_POST['username']) || empty($_POST['password'])) { $errors[] = "Both fields are required."; recordFailedAttempt(); } else { $username = trim($_POST['username']); $password = $_POST['password']; // In real app: query database here if (isset($users[$username]) && password_verify($password, $users[$username])) { // Success $_SESSION['user'] = $username; $_SESSION['logged_in'] = true; $_SESSION['login_time'] = time(); // Reset failed attempts unset($_SESSION['login_attempts']); unset($_SESSION['lockout_time']); $success = true; // header("Location: dashboard.php"); exit; ← uncomment in real app } else { $errors[] = "Invalid username or password."; recordFailedAttempt(); } } } ?> Login • Secure Example

Sign In

Too many failed attempts.
Please wait minutes.