一个登录的功能

一个登录，不仅仅是判断用户名密码正确与否，为了防止被他人攻击，还要注意加强安全性，此处是我做的一个较完整的登录

需实现的地方：
1.用户名密码正确
2.三次错误后该用户被锁
3.三次错误后，此ip的所有用户都不能登录
4.登录成功将错误次数，时间改变
5.登录成功后，页面若停留15分钟未动，则登录失效

login的代码例子如下：

function login() {      $username = $this->input->post('username');    $password = md5(md5($username.$this->input->post('password')));    $loginip=$_SERVER['REMOTE_ADDR'];//获取URL地址        if ($username == "") {            $this->load->view('login');        } else {/* $sql="select * from user b,(select userid ,if(verify_time is null,0,verify_time) as time from user) t where b.username=? AND b.password=? AND (b.admin=? or b.admin =?)  AND t.time!=-1 and t.userid=b.userid";    */    $sql="select * from user where b.username=? AND b.password=? AND (b.admin=? or b.admin =?)  AND b.verify_time!=-1 ";       $row = $this->db->query($sql,array($username,$password,1,2))->row();    $sql = "select * from userb where b.username=? AND (b.admin=? or b.admin =?)  AND b.verify_time!=-1 ;";    $re2 = $this->db->query($sql,array($username,1,2))->row();    $sql = "select * from user b where b.username=? AND (b.admin=? or b.admin =?)  AND b.verify_time=-1;";    $re5 = $this->db->query($sql,array($username,1,2))->row();    $sql="select * from t_login_conf ";    $pz=$this->db->query($sql)->row();    $sql = "select * from user b where b.verify_time!=-1 and b.userid=?;";    $re1=$this->db->query($sql,array($re2->userid))->row();    $times=$re1->login_error;    $rebegintime=$re1->verify_time;    // $nowtime = date('Y-m-d H:i:s',time());    $nowtime = time();    // $jtime=floor(((strtotime($nowtime)-strtotime($re1->verify_time))%86400/60)/60);    $jtime=floor((($nowtime - ($re1->verify_time))%86400/60)/60);    if($jtime > 12){        $sql="update user set login_error=?,login_ip=null,verify_time=? where userid=?";        $this->db->query($sql,array(0,time(),$re2->userid));    }else{        if($times > $pz->login_error_count){            if($nowtime >$rebegintime){                              $sql="update user set login_error=?,login_ip=null,verify_time=? where userid=?";                $this->db->query($sql,array(0,time(),$re2->userid));                    }                }            }            $sql = "select * from user b where b.verify_time!=-1 and b.userid=?;";            $re4=$this->db->query($sql,array($re2->userid))->row();            $times=$re4->login_error;            $re3=$this->db->query("select login_ip from t_webuser")->result();            $judgementip=0;            foreach($re3 as $rr){                if(!empty($rr->login_ip)){                    if($loginip==$rr->login_ip){//当前ip只要与被锁ip中一个相同，那么所有的用户在当前ip上就都不能登录                        $judgementip=1;                    }                }            }            if($judgementip==0){//ip未被锁            if($times <= $pz->login_error_count){//错误次数                if ($row) {                    $expiretime=time()+($pz->sessionlivetime)*60;                    $this->session->set_userdata('expiretime',$expiretime);                    $this->session->set_userdata (                        'admin_userdata',                        array(                            "userid"    => $row->userid,                            "username"  => $row->username,                            "admin"     => $row->admin,                            "expiretime" => $expiretime,                            "sessionlivetime"=>$pz->sessionlivetime,                            "login_lock_time" =>$pz->login_lock_time                        )                    );                    $admin=$row->admin;                    if($admin==1){                        $sql="update user set login_error=?,verify_time=? where userid=?";                                         $this->db->query($sql,array(0,time(),$row->userid));                        $data = array(                            "userid"    => $row->userid,                            "time"      => $_SERVER['REQUEST_TIME'],                            "log"       => $row->username ."登录成功",                        );                        $this->db->insert('t_webscan_log', $data);                        echo '{"title":"","message":"","url":"/yoda/systemwelcome","target":"refresh"}';                    }else{                        echo '{"title":"","message":"","url":"/yoda/index","target":"refresh"}';                    }                } else {                    if($times < $pz->login_error_count){                            $times++;                        }else{                            $times=$pz->login_error_count;                        }                    if($times >= ($pz->login_error_count)){                            $rebegintime = time()+($pz->login_lock_time)*60;                            $sql="update user set login_error=?,verify_time=?,login_ip=? where userid=?";                            $this->db->query($sql,array($times,$rebegintime,$loginip,$re2->userid));                    }else{                            $sql="update user set login_error=?,verify_time=? where userid=?";                            $this->db->query($sql,array($times,time(),$re2->userid));                    }                    $ll=$this->db->query("select login_error from user where userid=?",array($re2->userid))->row();                    if(empty($re5)){                        if(empty($re2)){                        echo '{"title":"登录失败","message":"用户名或者密码错误！","url":""}';                        }else{                            $message="密码错误，还有 ".(($pz->login_error_count)-($ll->login_error)) ." 次机会！";                            echo '{"title":"登录失败","message":"'.$message.'","url":""}';                        }                    }else{                        echo '{"title":"登录失败","message":"该用户被锁！","url":""}';                    }                }//if            }else{                $message=$pz->login_error_count ." 次机会已用完，请 ".$pz->login_lock_time ." 分钟后再登录！";                // $rebegintime = date("Y-m-d H:i:s",strtotime($re1->verify_time)+($pz->login_lock_time)*60);                echo '{"title":"登录失败","message":"'.$message.'","url":""}';            }//times        }else{            $message="当前ip已被锁，请 ".$pz->login_lock_time ." 分钟后再登录！";            echo '{"title":"登录失败","message":"'.$message.'","url":""}';        }//judgementip        }       }