php 限制错误登录次数

<?php
session_start();

// 假设我们有一个数据库表 user_login_attempts 存储登录尝试次数
$db = new PDO('mysql:host=localhost;dbname=test', 'username', 'password');

$username = $_POST['username'];
$password = $_POST['password'];

// 检查是否达到最大尝试次数
$stmt = $db->prepare("SELECT attempts FROM user_login_attempts WHERE username = ?");
$stmt->execute([$username]);
$result = $stmt->fetch();

if ($result && $result['attempts'] >= 5) {
    die("登录尝试次数过多，请稍后再试。");
}

// 验证用户名和密码
$stmt = $db->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, password_verify($password, $hashedPassword)]);

if ($stmt->rowCount() > 0) {
    // 登录成功，重置尝试次数
    $stmt = $db->prepare("UPDATE user_login_attempts SET attempts = 0 WHERE username = ?");
    $stmt->execute([$username]);
    echo "登录成功！";
} else {
    // 登录失败，增加尝试次数
    if ($result) {
        $attempts = $result['attempts'] + 1;
        $stmt = $db->prepare("UPDATE user_login_attempts SET attempts = ? WHERE username = ?");
        $stmt->execute([$attempts, $username]);
    } else {
        $stmt = $db->prepare("INSERT INTO user_login_attempts (username, attempts) VALUES (?, 1)");
        $stmt->execute([$username]);
    }
    echo "用户名或密码错误。";
}
?>