CodeIgniter; disable login after nth unsuccessful attempts

Question

I want to workout a functionality such that unsuccessful login attempts of users are capped at 5, then serve them a message to that effect.

Below is my codes:

$attempts = $this->input->post('attempts');

if ($attempts <= '5')
{
    $this->db->where('username', $username);
    $this->db->set('attempts', '`attempts`+ 1', FALSE);
    $this->db->update('tb_user');
}
else
{
    echo "Your account is locked!";
}

The above codes can update the database table and column attempts but records are still updating after the 5 attempts as in: storing the 6th, 7th, and nth unsuccessful login attempts.

What am I doing wrong and how can I resolve it?

Answer 1

Get the attemps count from database instead of passing from frontend.

$attempts = $this->db->where('username', $username)->get('tb_user')->row()->attempts;

    if ($attempts > 4)
    {
        echo "Your account is locked!";
    }
    else
    {
        $this->db->where('username', $username);
        $this->db->set('attempts', ($attempts + 1), FALSE);
        $this->db->update('tb_user');
    }