[Wayne Luke]

Member.php really has nothing to do with logging in.. Sure it has an action there to account for it, but that is just to show a template and do the proper redirects.

You could enter it in every file but that is kind of redundant and unmaintainable.

The file you are looking for is session.php. This file handles the logging in of every member whether from form or cookie and more importantly it controls the session table where the information you need is located.

A little pseudo code of how I would do it is:

logging in
check userid
if userid exists in session table
  redirect to error page
  increment invalid login counter.
  max invalid logins reached?
     lock account (flag on user table).
else
  continue with login and proceed.