Unsuccessful Logins
<p>So when the user unsuccessfully logs in for the first time it performs the tasks 70-73 and then it jumps down to 111. That part works correctly however when the chances left gets to 0 meaning the failedLogins value in the db would be 5 its supposed to do the steps starting at line 76 but it doesn't. Instead it shows 0 for the chances left and then that's it. I'm sure my logic is right but the the code is just placed in the wrong places. </p>

<p><a href="http://pastebin.com/p3n1Fr78" rel="nofollow">Pastebin</a></p>

<pre><code>// User is registered and verified

                $query = "SELECT * FROM manager_users_logins_hacking WHERE userID = '".$userID."'";
                $result = mysqli_query($dbc,$query);
                $row = mysqli_fetch_array($result);

                $lockDate = $row['lockDate'];

                // Find out if user is locked out of their account
                if (($lockDate !== "0000-00-00 00:00:00") AND (strtotime($lockDate) &lt;= time())) {

                    $currentDateTime = time();
                    $minutes = floor(($currentDateTime-$lockDate) / 60);

                    // Take minutes and perform tasks
                    if ($lockDate &gt; 0 &amp;&amp; $minutes &lt; 10) {

                        // Calculate time remaining
                        $timeRemaining = 10 - $minutes;

                        // Account locked error
                        $output = array('errorsExist' =&gt; true, 'message' =&gt; 'Your account is currently locked, we appologize for the inconvienence. You must wait ' .$timeRemaining.' minutes before you can log in again!');

                    } else {

                        // Clear the lock
                        $query = "UPDATE manager_users_logins_hacking SET lockDate = NULL, hackerIPAddress = NULL, failedLogins = 0 WHERE userID = '".$userID."'";
                        $result = mysqli_query($dbc,$query);

                    } 

                } else {

                    // Escape post data
                    $password = mysqli_real_escape_string($dbc,$_POST['password']);

                    // Assign hashed password to variable
                    $regenFromPostPW = reGenPassHash($password, $passwordDB2);

                    // Comparing the database password with the posted password
                    if ($passwordDB == $regenFromPostPW) {

                        $query2 = "UPDATE manager_users_logins SET numberOfLogins = numberOfLogins + 1, lastOnline = CURRENT_TIMESTAMP WHERE userID = '".$userID."'";
                        $result2 = mysqli_query($dbc,$query2);

                        // Assign user data into an array
                        $loggedinUserDataArray = array('userID' =&gt; $userID, 'name' =&gt; $firstName . " " . $lastName);

                        // Assign user data array to new session
                        $_SESSION['user_data'] = $loggedinUserDataArray;

                        // See if the remember me checkbox was checked
                        if (isset($_POST['remember'])) {

                            // Sets an expiration time for the cookie
                            $myExpiration = time()+60*60*24*100;

                            // Sets the cookie for the username
                            setcookie("username", $username, $myExiration, "/");

                        }

                        // Succesful login complete
                        $output = array('errorsExist' =&gt; false, 'message' =&gt; 'You have been logged in, please allow a moment while we load your account data!');

                    } else {

                        // Login unsuccessful

                        $query = "SELECT * FROM manager_users_logins_hacking WHERE userID = '".$userID."'";
                        $result = mysqli_query($dbc,$query);
                        $row = mysqli_fetch_array($result);
                        $failedLogins = $row['failedLogins'];

                        // Take failed logins and compare it 
                        if ($row['failedLogins'] &gt;= 5) {

                            // Retrieve IP Address of user trying to hack into account
                            $hackerIPAddress = $_SERVER['REMOTE_ADDR'];

                            // Update database after account getting hacked and run query
                            $query = "UPDATE manager_users_logins_hacking SET lockDate = CURRENT_TIMESTAMP, hackerIPAddress = '".$hackerIPAddress."' WHERE userID = '".$userID."'";
                            $result = mysqli_query($dbc,$query);

                            $query2 = "SELECT * FROM manager_users WHERE userID = '".$userID."'";
                            $result2 = mysqli_query($dbc,$query2);
                            $row = mysqli_fetch_array($result2);
                            $firstName = $row['firstName'];
                            $lastName = $row['lastName'];

                            // Email user new registration account
                            function my_domain_name() {
                                $my_domain = $_SERVER['HTTP_HOST'];
                                $my_domain = str_replace('www.', '', $my_domain);
                                return $my_domain;
                            }
                            $sender_email = "noreply@kansasoutlawwrestling.com";
                            $reply_to = "noreply@kansasoutlawwrestling.com";
                            $recipient_email = $email; 
                            $email_subject = "KOW Manager Account Locked";

                            $email_body = 'Hello '.$firstName.' '.$lastName.' You, or someone using your account at '.my_domain_name().', has attempted to hack into your account. If this is an error, ignore this email and you will be removed from our mailing list.&lt;br /&gt;&lt;br /&gt;Regards, '.my_domain_name().' Team';

                            mailSomeone($email, $sender_email, $email_subject, $email_body);

                            // Account locked error
                            $output = array('errorsExist' =&gt; true, 'message' =&gt; 'Your account is currently locked, we appologize for the inconvienence. This is a security messure implimented by to many failed login\'s! You must wait 10 minutes before you can login again!');         

                        } else {

                            $query = "UPDATE manager_users_logins_hacking SET failedLogins = '".$failedLogins."'+ 1 WHERE userID = '".$userID."'";
                            $result = mysqli_query($dbc,$query);

                            $query2 = "SELECT * FROM manager_users_logins_hacking WHERE userID = '".$userID."'";
                            $result2 = mysqli_query($dbc,$query2);
                            $row2 = mysqli_fetch_array($result2);
                            $failedLogins = $row2['failedLogins'];

                            // Calculate how many chances the user has to login before account gets locked
                            $chancesLeft = 5 - $failedLogins;

                            // Invalid username and password error 
                            $output = array('errorsExist' =&gt; true, 'message' =&gt; 'Invalid Username and Password combination! You have ' .$chancesLeft.' chances left to login succesfully or the account will be locked!'); 

                        }

                    }

                }
</code></pre>
