How to check 3 consecutive wrong password entries

Question

Hi to All,
I'm new to jsp. I've created a login page using
String user = request.getParameter("username");
        String pwd = request.getParameter("pass");
String query = "select * from userinfo where username='" + user + "' and pass='" + pwd + "'";It's working fine. Now assuming that when the user enters the wrong password for 3 consecutive time means the username should be locked in the database. My table fields are username and password.
How can i do this. Plese suggest me an idea.
Thanks in Advance.

Answer 1

Why not using a 'locked_until' date column in the DB?
In the 'business bean' you simple count 'login_attempts' and if too may failed logins you lock the user in the DB.
Example:
If login_attempts>3 then
- execute: "update user set locked_until = sysdate + 1/(24*4) where username = ?"
- reset login_attempts
- show warning: "you cannot login for 15 minutes"
Just my 2 cents...