I am building a library and I need suggestions on how to improve it (security, performance, etc).<?php/** * Authentication Library * * @author John Svensson */class Auth{    public $captchaCount;    protected $db;    protected $PasswordLib;    private $message;    public function __construct(PDO $db, PasswordLib\PasswordLib $PasswordLib)    {        $this->db = $db;        $this->PasswordLib = $PasswordLib;    }    public function login($username, $password) {        try {            $sth = $this->db->prepare(SELECT id, username, password, active FROM user WHERE username = ?);            $sth->setFetchMode(PDO::FETCH_OBJ);            $sth->execute(array($username));            $result = $sth->fetch();        } catch (PDOException $e) {            throw new Exception($e->getMessage());        }        if ($result) {             if ($this->PasswordLib->verifyPasswordHash($password, $result->password)) {                if ($result->active == 0) {                    $this->setMessage(<p>You must activate your account!</p>);                    return FALSE;                }                session_regenerate_id();                $_SESSION['userid'] = $result->userid;                return TRUE;            } else {                $this->addLoginAttempt($username);                $this->captchaCount++;                $this->setMessage(<p>The password you entered is incorrect. Please try again.</p><p>Forgot your password? <a href=\forgotpassword.php\>Request a new one.</a>);                return FALSE;            }                 } else {            $this->addLoginAttempt($username);            $this->captchaCount++;            $this->setMessage(<p>Incorrect username</p>);            return FALSE;        }    }    public function IsLoggedIn() {        if (isset($_SESSION['userid'])) {            return TRUE;        }    }    public function getLoginAttempts() {        $ip_address = ip2long($_SERVER['REMOTE_ADDR']);        $sth = $this->db->prepare(SELECT COUNT(*) FROM login_attempts WHERE ip_address = ? AND attempted > DATE_SUB(NOW(), INTERVAL 15 minute));        $sth->bindParam(1, $ip_address);        $sth->execute();        return $sth->fetchColumn();    }    private function addLoginAttempt($username) {        $ip_address = ip2long($_SERVER['REMOTE_ADDR']);        $sth = $this->db->prepare(INSERT INTO login_attempts(username, ip_address, attempted) VALUES(?, ?, NOW()));        $sth->execute(array($username, $ip_address));    }    public function getMessage() {        return $this->message;    }    private function setMessage($value) {        $this->message = $value;    }}?><?php$data = array();$Auth->captchaCount = $Auth->getLoginAttempts();var_dump($Auth->captchaCount);if ($Auth->captchaCount > 0) {    //sleep (2 ^(intval($count) -1));}$data['captcha'] = false;if ($Auth->captchaCount > 9) {    $data['captcha'] = true;}if (isset($_POST['submit'])) {    if (isset($_POST['token']) && $_POST['token'] === $_SESSION['token']) {        if ($data['captcha']) {            $resp = recaptcha_check_answer ($private_key,                                        $_SERVER[REMOTE_ADDR],                                        $_POST[recaptcha_challenge_field],                                        $_POST[recaptcha_response_field]);            if (!$resp->is_valid) {                $data['error'] = 'The reCaptcha was entered incorrectly.';            }        }        if (!isset($data['error'])) {            if ($Auth->login($_POST['username'], $_POST['password'])) {            } else {                $data['error'] = $Auth->getMessage();                if ($Auth->captchaCount > 9) {                    $data['captcha'] = true;                }            }        }    } else {    }}$data['token'] = $_SESSION['token'];$data['public_key'] = $public_key;echo $twig->render('login.html', $data);?>
Authentication library
php;performance;security;library;authentication