What are the potential pitfalls of using sessions and cookies for counting login attempts in PHP?

Using sessions and cookies for counting login attempts in PHP can be insecure as they can easily be manipulated by the user. A more secure approach would be to store the login attempts in a database and validate the login attempts against the database. 

// Store login attempts in a database table
// Create a table named 'login_attempts' with columns 'id', 'username', 'timestamp'

// Check login attempts against the database
function checkLoginAttempts($username) {
    $db = new mysqli('localhost', 'username', 'password', 'database');

    $stmt = $db->prepare("SELECT COUNT(*) FROM login_attempts WHERE username = ? AND timestamp >= DATE_SUB(NOW(), INTERVAL 1 HOUR)");
    $stmt->bind_param('s', $username);
    $stmt->execute();
    $stmt->bind_result($count);
    $stmt->fetch();

    $stmt->close();
    $db->close();

    return $count;
}

Keywords

sessions cookies login attempts security PHP

Related Questions