Secure PHP Login Script

PHP Login Script SQL Injection Session hijacking attack Network Eavesdropping Cross-site Scripting Blocking Brute Force Attacks PHP Functions function sec_session_start() [PHP sessions] function login($email, $password, $mysqli) [Login Function] function checkbrute($user_id, $mysqli) [Brute Force Function] function login_check($mysqli) [logged in status] function esc_url($url) [Sanitize URL from PHP_SELF] hashing algorithm sha512 ============================================================================================= Forms: Login username or mail password stay connected (Remember login for 15 days) Forger password (send email link to rest pass - link alive for 60 mins) Register First name Last name e-mail password verify password capcha code Forget password e-mail captcha code Change password e-mail old password new password verify new password New password new password captcha ============================================================================================= User Roles: Administrator (access all pages and admin panel) Super User (access all pages) user (User can view only some pages) guest (access only public pages) ============================================================================================= registration process: First name (check if is empty) Last name (check if is empty) e-mail (check if mail is the for ) password (password must be at least 6 characters + One uppercase + one number + one symbol) captcha code registered users are always deactivated! two ways activation 1) by mail 2) admin can activate the user manually via admin panel IF 3 times unsuccessful registration form IP added to block list ============================================================================================= Login Process: e-mail password stay connected forget password **** Deactivated users will be informed that there are deactivated. If user enters wrong password captcha required. 3 times wrong password, IP will be blocked and all traffic from this ip will go to page 404 error ============================================================================================== forget password user becomes deactivated e-mail send with a link (60 mins link live) link point to new password form ============================================================================================== Admin panel users list change user role activate - deactivate a user Add & Remove blocked IP Add & remove entire subnet (ex [login to view URL])