Php Lockout User After 3 Failed Log Ins For 10 Minutes

I have the code for a log in system almost done. I have it working that a user gets 3 attempts to login and receive a message each time saying that they have a certain number of at

Solution 1:

After verifying the account information, check if they should be locked out.

if(mysql_num_rows($checkloginEmp) == 1)
        {
            // Check if they're locked out$checkLockout = mysql_query("SELECT * FROM login
                                         WHERE LoginID = $userID
                                         AND failed_login_attempts >= 3
                                         AND last_failed_login > DATE_SUB(NOW(), INTERVAL 10 MINUTE)"ordie (mysql_error());
            if (mysql_num_rows($checkLockout) > 0) {
                echo"Locked out!";
            } else {
                $row = mysql_fetch_array($checkloginEmp);
                $_SESSION['Username'] = $userID;
                $_SESSION['FName'] = $row['FName'];
                $_SESSION['SName'] = $row['SName'];
                $_SESSION['LoggedIn'] = 1;
            }

            echo"<meta http-equiv='refresh' content='1;CareMarkLogin2.php'/>";
        }

Alternatively, you could check this before validating the password.