Prevent attack on login using sessions in php
===

i'm trying to use sessions to store the amount of login attempts. When the maximum of login attempts is reached i'm storing the client's ip address in a blacklist table.

Some things i've taken into account, you might need to know about:

 - I'm using `session_regenerate_id();` after i set a session value.
 - I'm not using any cookies apart from the session since this is not necessary and not 2012 :p
 - The users ip is blacklisted until i mannually delete his row from the blacklist table.
 - The `SESSION_MAX_ATTEMPTS` is a defined constant and set to 5.
 - The `index.php?module=login&task=blacklist` page is just showing the user a message that it's blacklisted. This page does not have any functionallity. 
 - i'm using a custom build php framework, so i had to translate some OOP called method's to simplified php code.

The following function is called before a login query is executed:

    private function preventAttack()
    {
		$blocked = getData("SELECT count(*) as blocked FROM blacklist WHERE ip = @Value0;", Array( $_SERVER['REMOTE_ADDR'] ));
		if($blocked[0]["blocked"] == "1")
		{
		    redirect("index.php?module=login&task=blacklist");
		}
		$old = (int)$this->session->get("login_attempts");
		if(!empty($old))
		{			
			if($old > SESSION_MAX_ATTEMPTS)
			{
				setData("INSERT INTO blacklist SET ip = @Value0;", Array( $_SERVER['REMOTE_ADDR'] ));
				redirect("index.php?module=login&task=blacklist");
			}
			else
			{
				$old++;
				$this->session->set("login_attempts",$old);
			}
		}
		else
		{
			$this->session->set("login_attempts", 0);
		}
	}

The first if statement works including both query's but i'm stuck at what's the best way to store the amount of attempts and what's the best way to ++ it? Maybe you guys can set me in the right direction.

If you have any questions about my code, please add a comment. I know it's a bit unreadable since it's from my framework, i've translated this a bit before posting it.