Lock users on unsuccessful logins?

what do you mean by lock?

can't access the site? or can't try to login again and can view the site?

it can be done , no sure way but you can use cookies, if a value send them away, or session veriables.... and/or store the IP Address , thats not fool proff though

ok add a new field to the DB.

then on the login page when a inccorect value use aupdate SQL to add 1 to the field. then if 3 always return false.

but if correct within three where the last login time is done add the counted field setting the value back to 0

then to actually stop the user .. in the common.asp page change the query that uses the Usercode to log the user in.. set the query to also check the user_code but also WHERE tblAuthor.Count = 0

if they dont equal 0 set them to a guest account .. or you can not check within the query and bring the value in.. where the user details are bought in.

then do a if statement saying if >2 then blnActiveUser = False

set them to inactive