如何限制登录尝试次数为3次？计数器失效及报错问题求助

我在实现登录3次限制功能时遇到以下问题：

• counter无法递增
• 使用while循环会陷入死循环
• 移除global counter下的counter = 1会触发NameError（名称未定义）报错

相关代码 #

counter = 1

pg3_txtbox_username = Entry(page3, borderwidth=0, width=16, font=('Arial',30))
pg3_txtbox_username.place(x=116, y=256, height=92)
pg3_txtbox_pass = Entry(page3, borderwidth=0, width=16, font=('Arial', 30), show='*')
pg3_txtbox_pass.place(x=116, y=422, height=90)

def verify():
    conn = sqlite3.connect("data/data.db")
    cursor = conn.cursor()

    global counter
    counter = 1  # 问题根源：每次调用都重置计数器
    uname = pg3_txtbox_username.get()
    pwd = pg3_txtbox_pass.get()
    adm = "Admin"
    state = "On"
    
    if uname=='' or pwd=='':
        messagebox.showinfo("Error", "Please Fill The Empty Field!!")
    elif counter <=3:
        # 存在SQL注入风险，建议用参数化查询
        cursor.execute("SELECT * FROM faculty_data WHERE Username = '" + str(uname) + "' AND  Password = '" + str(pwd) + "' AND  Position = '" + str(adm) + "' AND Status ='" + str(state) + "'")
        if cursor.fetchone():
            show_frame(page4)
            messagebox.showinfo("Messgae", "WELCOME USER")

            pg3_txtbox_username.delete(0, END)
            pg3_txtbox_pass.delete(0, END)
            check_button.deselect()

        else:
            counter += 1
            messagebox.showinfo("Error", "Reamaining Attempt: "+ str(counter))
            pg3_txtbox_username.delete(0, END)
            pg3_txtbox_pass.delete(0, END)
            check_button.deselect()

运行结果 #

输入错误账号密码后，弹窗提示剩余尝试次数，但每次重新输入错误时，提示的剩余次数并未正确递减，始终停留在初始错误后的数值。

报错信息 #

"C:\Users\kenjo\OneDrive\Documents\PythonProject\face_recognition\face_recog.py", line 516, in verify
 elif counter <=3: 
NameError: name 'counter' is not defined

解决方法 #

1. 修复计数器重置问题：删除verify()函数内的counter = 1，只在登录成功或者登录次数超限后重置计数器，确保每次错误尝试能正确累加。
2. 避免NameError：确保global counter声明在函数内的最上方，且全局变量counter = 1在函数外正确初始化。
3. 替换while循环：GUI应用是单线程模型，while循环会阻塞事件循环导致界面卡死，直接用全局计数器记录尝试次数即可，无需循环。
4. 修复剩余次数计算：当前提示的剩余次数逻辑错误，应该用3 - counter +1来显示剩余次数（比如counter=1时剩余3次，counter=2时剩余2次）。
5. 解决SQL注入风险：不要用字符串拼接SQL语句，改用参数化查询。

修复后的完整代码示例：

counter = 1

pg3_txtbox_username = Entry(page3, borderwidth=0, width=16, font=('Arial',30))
pg3_txtbox_username.place(x=116, y=256, height=92)
pg3_txtbox_pass = Entry(page3, borderwidth=0, width=16, font=('Arial', 30), show='*')
pg3_txtbox_pass.place(x=116, y=422, height=90)

def verify():
    global counter
    conn = sqlite3.connect("data/data.db")
    cursor = conn.cursor()

    uname = pg3_txtbox_username.get()
    pwd = pg3_txtbox_pass.get()
    adm = "Admin"
    state = "On"
    
    if uname=='' or pwd=='':
        messagebox.showinfo("Error", "请填写所有字段！")
        return
        
    if counter > 3:
        messagebox.showinfo("Error", "登录次数超限，请稍后再试")
        return
        
    # 参数化查询避免SQL注入
    cursor.execute("SELECT * FROM faculty_data WHERE Username = ? AND Password = ? AND Position = ? AND Status = ?", 
                   (uname, pwd, adm, state))
    if cursor.fetchone():
        show_frame(page4)
        messagebox.showinfo("消息", "欢迎用户")
        pg3_txtbox_username.delete(0, END)
        pg3_txtbox_pass.delete(0, END)
        check_button.deselect()
        counter = 1  # 登录成功后重置计数器
    else:
        counter += 1
        remaining = 3 - counter + 1
        messagebox.showinfo("Error", f"剩余尝试次数: {remaining}")
        pg3_txtbox_username.delete(0, END)
        pg3_txtbox_pass.delete(0, END)
        check_button.deselect()
        
    conn.close()  # 关闭数据库连接

内容的提问来源于stack exchange，提问作者zhun3