<?php
session_start();

$current_time = time();

if (isset($_SESSION['counter']))
{
    if ($_SESSION['counter']>1)
    {
        if ((time() - $_SESSION['time'])<60)
        {
            echo "Too many attemps. Please wait 60secs";
            exit;
        }
        else
        {
            $_SESSION['time'] = time();
            $_SESSION['counter'] = 0;
        }
    }
}

if (!isset($_SESSION['user_id']))
if (isset($_POST['auth_name'])) {

  // здесь коннектимся к базе, запрашиваем пользователя с нужными логином/паролем
  // ...

  $result = mysql_query($query, $link);

  if ($row = mysql_fetch_array($result, MYSQL_ASSOC))
  {

    session_start();
    $_SESSION['user_id'] = $row['id'];
    $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
    $_SESSION['test_string'] = $row['test_string'];
    $_SESSION['name'] = $row["name"];
    echo "Logged in as ".$row['name']."; ".$row['test_string'];
              show_data();
  }
  else
  {
    if (isset($_SESSION['counter']))
    {
        $_SESSION['counter']++;
        echo "Try: ".$_SESSION['counter'];
    }
    else
    {
        $_SESSION['counter'] = 0;
        $_SESSION['time'] = time();
        echo "Flag: invalid\n";
    }
  }

  mysql_free_result($result);
  mysql_close($link);
  exit;
}

if (isset($_GET['action']) AND $_GET["action"]=="logout") {
  session_start();
  session_destroy();
  echo "Flag: closed";
  exit;
}


if (isset($_REQUEST[session_name()])) session_start();
if (isset($_SESSION['user_id']) AND $_SESSION['ip'] == $_SERVER['REMOTE_ADDR'])
{
    echo "Flag: OK\n";
    echo "Already logged as ".$_SESSION['name']."; ".$_SESSION['test_string'];
              show_data();
    exit;
}
else
{
  session_start();
  echo "Flag: autentification";
?>
<form method="POST">
<input type="text" name="auth_name"><br>
<input type="password" name="auth_pass"><br>
<input type="submit"><br>
</form>
<?php
}
exit;
?>