I am trying to create for the first time a lock out system on my CMS. So is the code below sufficient for locking out impostors. This code is included onto the login page and has a few other files to help support it.
<?PHP
$ip = $_SERVER['REMOTE_ADDR'];
include("../Connections/default.php");
mysql_select_db($database_default, $default);
$query_uvs2 = "SELECT * FROM login WHERE `ip` = '".$ip."' ";
$uvs2 = mysql_query($query_uvs2, $default) or die(mysql_error());
$total_fails = mysql_num_rows($uvs2);
if($_REQUEST["error"] == "1")
{
$lockout = "10";//Maximum lockout attempts.
if($total_fails >= $lockout)
{
include('functions/standard.php');
date_default_timezone_set("America/New_York");
e_log("security", "IP Ban for Brute Force (Possibly Page Refreshing)",$_SERVER['REMOTE_ADDR']);
die("One does not simply brute force, to appeal this IP ban please empty the table login");
}
else
{
include("../Connections/default.php");
mysql_select_db($database_default, $default);
$addmenu = "INSERT INTO login (`ip`) VALUES ('$ip')";
mysql_query($addmenu, $default) or die(mysql_error());
}
}
?>