if (isset($_POST['is_submit'])) {

	$receivedLogin = trim($_POST['login']);
	$receivedPassword = trim($_POST['password']);

	if (!empty($receivedLogin) && !empty($receivedPassword)) {
		$sthBannedSelect = $db -> prepare('SELECT UNIX_TIMESTAMP(date + INTERVAL 3 MINUTE) AS block_date, try_count FROM banned_ip WHERE ip=INET_ATON(?)');
		$sthBannedSelect -> execute(array($_SERVER['REMOTE_ADDR']));
		$sthBannedSelect -> bindColumn('block_date', $blockDate);
		$sthBannedSelect -> bindColumn('try_count', $tryCount);
		$sthBannedSelect -> fetch();

		if (time() - intval($blockDate) <= 0 && $tryCount >= 3)
			$needBan = TRUE;

		if ($needBan) {
			$message = 'Вы заблокированы до ' . date('H:i:s \G\M\T P', $blockDate);
		} else {
			$sthClientsSelect = $db -> prepare('SELECT password, type FROM users WHERE login=?');
			$sthClientsSelect -> execute(array($receivedLogin));
			$sthClientsSelect -> bindColumn('password', $realPassword);
			$sthClientsSelect -> bindColumn('type', $userType);
			$sthClientsSelect -> fetch();

			if ($realPassword == md5($receivedPassword)) {
				$db -> exec('DELETE FROM banned_ip WHERE (UNIX_TIMESTAMP() - UNIX_TIMESTAMP(date + INTERVAL 3 MINUTE)) > 0');

				$_SESSION['login'] = $receivedLogin;
				$_SESSION['user_type'] = $userType;
				$_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
				
				header("Location: index.php");
				die ;
				
			} else {
				$message = 'Количество неверных попыток ограничено!';
				
				$sthBannedCount = $db -> prepare('SELECT COUNT(*) FROM banned_ip WHERE ip=INET_ATON(?)');
				$sthBannedCount -> execute(array($_SERVER['REMOTE_ADDR']));
				if ($sthBannedCount -> fetchColumn()) {

					$db -> prepare('UPDATE banned_ip SET try_count=try_count + 1, date=NOW() WHERE ip=INET_ATON(?)') -> execute(array($_SERVER['REMOTE_ADDR']));
				} else {
					$sthBannedInsert = $db -> prepare('INSERT INTO banned_ip(ip, date, try_count) VALUES(INET_ATON(?), NOW(), 1)');
					$sthBannedInsert -> execute(array($_SERVER['REMOTE_ADDR']));
				}

			}
		}
	}
}

if (!empty($receivedLogin) && !empty($receivedPassword)) 

if ((isset($receivedLogin) && $receivedLogin != '') && (isset($receivedPassword) && $receivedPassword != ''))

Спустя 1 час, 9 минут, 52 секунды (29.10.2011 - 19:30) imbalance_hero написал(а):

Чисто? Тут тоже? $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];

 !== '' 

Спустя 2 минуты, 2 секунды (29.10.2011 - 19:34) Гость_Дмитрий написал(а):

Цитата

Чисто? Тут тоже? $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];

Не понял, в чем подвох?

 
if (empty($_SESSION['login']) || $_SESSION['user_agent'] !== $_SERVER['HTTP_USER_AGENT'])
{
	header("Location: auth.php");
	die ;
}