August 30, 2026

Block Compromised Passwords and High-Risk IP Addresses

PHPRunner and ASPRunner.NET already provide password policies, encrypted password storage, CAPTCHA, two-factor authentication, and user permissions. In this tutorial, we will add two more checks: reject passwords found in known data breaches and block visitors whose IP addresses have a very high abuse score.

During registration, haveibeenpwned.com checks whether the password has appeared in known data breaches. The password itself is never sent to the service, and this API does not require a key.

Before processing an application page, abuseipdb.com checks whether the visitor’s IP address has been associated with abusive activity. This service requires an API key. Section 6 explains how to create that key. The results are cached locally to reduce the number of external requests.

1. Creating the IP reputation cache table

The example project uses MySQL. Create the following table in the application’s database, then add it to the project on the Datasource tables screen.

CREATE TABLE ip_reputation_cache (
    ip_address VARCHAR(45) NOT NULL,
    abuse_score INT NOT NULL DEFAULT 0,
    total_reports INT NOT NULL DEFAULT 0,
    country_code VARCHAR(2) NULL,
    usage_type VARCHAR(100) NULL,
    checked_at DATETIME NOT NULL,
    PRIMARY KEY (ip_address)
);

2. Adding the reusable security-check functions

The first function creates a SHA-1 hash of the password and sends only its first five characters to Pwned Passwords. The remaining hash characters never leave the application.

The second function checks the local cache before contacting AbuseIPDB.

PHPRunner

Open Style Editor → Custom Files, create security_checks.php, and add this code:

<?php

function pwnedPasswordCount($password)
{
    $hash = strtoupper(sha1($password));
    $prefix = substr($hash, 0, 5);
    $suffix = substr($hash, 5);

    $ch = curl_init(
        "https://api.pwnedpasswords.com/range/" . $prefix
    );

    curl_setopt_array($ch, array(
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 5,
        CURLOPT_HTTPHEADER => array(
            "User-Agent: PHPRunner-PwnedPasswordCheck",
            "Add-Padding: true"
        )
    ));

    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($response === false || $httpCode != 200) {
        return -1;
    }

    foreach (preg_split('/\r\n|\r|\n/', $response) as $line) {
        $parts = explode(':', trim($line), 2);

        if (
            count($parts) == 2
            && strtoupper($parts[0]) === $suffix
        ) {
            return (int)$parts[1];
        }
    }

    return 0;
}

function ipCheckFailure($message)
{
    return array(
        "success" => false,
        "error" => $message
    );
}

function checkIPReputation($ipAddress, $apiKey)
{
    if (!filter_var($ipAddress, FILTER_VALIDATE_IP)) {
        return ipCheckFailure("Invalid IP address.");
    }

    $sql = DB::PrepareSQL(
        "SELECT *
         FROM ip_reputation_cache
         WHERE ip_address=':1'
         AND checked_at >= DATE_SUB(NOW(), INTERVAL 24 HOUR)",
        $ipAddress
    );

    $rs = DB::Query($sql);
    $cached = $rs ? $rs->fetchAssoc() : false;

    if ($cached) {
        return array(
            "success" => true,
            "cached" => true,
            "abuseScore" => (int)$cached["abuse_score"],
            "totalReports" => (int)$cached["total_reports"],
            "countryCode" => $cached["country_code"],
            "usageType" => $cached["usage_type"]
        );
    }

    $url = "https://api.abuseipdb.com/api/v2/check?"
        . http_build_query(array(
            "ipAddress" => $ipAddress,
            "maxAgeInDays" => 90
        ));

    $ch = curl_init($url);

    curl_setopt_array($ch, array(
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 5,
        CURLOPT_HTTPHEADER => array(
            "Accept: application/json",
            "Key: " . $apiKey
        )
    ));

    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($response === false || $httpCode != 200) {
        return ipCheckFailure("Unable to check IP reputation.");
    }

    $json = json_decode($response, true);

    if (!isset($json["data"])) {
        return ipCheckFailure("Unexpected AbuseIPDB response.");
    }

    $data = $json["data"];
    $abuseScore = (int)($data["abuseConfidenceScore"] ?? 0);
    $totalReports = (int)($data["totalReports"] ?? 0);
    $countryCode = $data["countryCode"] ?? "";
    $usageType = $data["usageType"] ?? "";

    DB::Exec(DB::PrepareSQL(
        "DELETE FROM ip_reputation_cache
         WHERE ip_address=':1'",
        $ipAddress
    ));

    DB::Exec(DB::PrepareSQL(
        "INSERT INTO ip_reputation_cache
         (ip_address, abuse_score, total_reports,
          country_code, usage_type, checked_at)
         VALUES (':1', :2, :3, ':4', ':5', NOW())",
        $ipAddress,
        $abuseScore,
        $totalReports,
        $countryCode,
        $usageType
    ));

    return array(
        "success" => true,
        "cached" => false,
        "abuseScore" => $abuseScore,
        "totalReports" => $totalReports,
        "countryCode" => $countryCode,
        "usageType" => $usageType
    );
}

Open Events → Global events → After App Init and load the file:

require_once("security_checks.php");

ASPRunner.NET

Open Style Editor → Custom Files, create security_checks.cs, and add this code. ASPRunner.NET compiles C# custom files with the generated application, so no separate include statement is required.

using System;
using System.IO;
using System.Net;
using System.Security.Cryptography;
using System.Text;
using System.Web;
using runnerDotNet;

namespace runnerDotNet
{
    public partial class CommonFunctions
    {
        public static int PwnedPasswordCount(string password)
        {
            byte[] bytes = Encoding.UTF8.GetBytes(password);
            byte[] digest;

            using (SHA1 sha1 = SHA1.Create())
            {
                digest = sha1.ComputeHash(bytes);
            }

            string hash = BitConverter.ToString(digest)
                .Replace("-", "")
                .ToUpperInvariant();

            string prefix = hash.Substring(0, 5);
            string suffix = hash.Substring(5);

            try
            {
                HttpWebRequest request = (HttpWebRequest)WebRequest.Create(
                    "https://api.pwnedpasswords.com/range/" + prefix
                );
                request.Method = "GET";
                request.Timeout = 5000;
                request.ReadWriteTimeout = 5000;
                request.UserAgent =
                    "ASPRunner.NET-PwnedPasswordCheck";
                request.Headers["Add-Padding"] = "true";

                using (HttpWebResponse response =
                    (HttpWebResponse)request.GetResponse())
                using (StreamReader reader = new StreamReader(
                    response.GetResponseStream()
                ))
                {
                    if (response.StatusCode != HttpStatusCode.OK)
                        return -1;

                    string body = reader.ReadToEnd();
                    string[] lines = body.Split(
                        new[] { "\r\n", "\n", "\r" },
                        StringSplitOptions.RemoveEmptyEntries
                    );

                    foreach (string line in lines)
                    {
                        string[] parts = line.Trim().Split(':');

                        if (
                            parts.Length == 2
                            && parts[0].ToUpperInvariant() == suffix
                        )
                        {
                            int count;
                            return Int32.TryParse(parts[1], out count)
                                ? count
                                : -1;
                        }
                    }
                }

                return 0;
            }
            catch
            {
                return -1;
            }
        }

        private static XVar IpCheckFailure(string message)
        {
            return new XVar(
                "success", false,
                "error", message
            );
        }

        public static XVar CheckIPReputation(
            string ipAddress,
            string apiKey
        )
        {
            if (String.IsNullOrWhiteSpace(ipAddress))
                return IpCheckFailure("Invalid IP address.");

            dynamic sql = DB.PrepareSQL(
                @"SELECT *
                  FROM ip_reputation_cache
                  WHERE ip_address=':1'
                  AND checked_at >= DATE_SUB(NOW(), INTERVAL 24 HOUR)",
                ipAddress
            );

            dynamic rs = DB.Query(sql);
            dynamic cached = XVar.Pack(rs) ? rs.fetchAssoc() : null;

            if (XVar.Pack(cached))
            {
                return new XVar(
                    "success", true,
                    "cached", true,
                    "abuseScore", cached["abuse_score"],
                    "totalReports", cached["total_reports"],
                    "countryCode", cached["country_code"],
                    "usageType", cached["usage_type"]
                );
            }

            string url =
                "https://api.abuseipdb.com/api/v2/check"
                + "?ipAddress=" + HttpUtility.UrlEncode(ipAddress)
                + "&maxAgeInDays=90";

            try
            {
                HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
                request.Method = "GET";
                request.Timeout = 5000;
                request.ReadWriteTimeout = 5000;
                request.Accept = "application/json";
                request.Headers["Key"] = apiKey;

                string responseText;

                using (HttpWebResponse response =
                    (HttpWebResponse)request.GetResponse())
                using (StreamReader reader = new StreamReader(
                    response.GetResponseStream()
                ))
                {
                    if (response.StatusCode != HttpStatusCode.OK)
                        return IpCheckFailure(
                            "Unable to check IP reputation."
                        );

                    responseText = reader.ReadToEnd();
                }

                dynamic json = MVCFunctions.runner_json_decode(responseText);

                if (!XVar.Pack(json) || !XVar.Pack(json["data"]))
                    return IpCheckFailure(
                        "Unexpected AbuseIPDB response."
                    );

                dynamic data = json["data"];
                dynamic abuseScore = data["abuseConfidenceScore"];
                dynamic totalReports = data["totalReports"];
                dynamic countryCode = data["countryCode"];
                dynamic usageType = data["usageType"];

                DB.Exec(DB.PrepareSQL(
                    @"DELETE FROM ip_reputation_cache
                      WHERE ip_address=':1'",
                    ipAddress
                ));

                DB.Exec(DB.PrepareSQL(
                    @"INSERT INTO ip_reputation_cache
                      (ip_address, abuse_score, total_reports,
                       country_code, usage_type, checked_at)
                      VALUES (':1', :2, :3, ':4', ':5', NOW())",
                    ipAddress,
                    abuseScore,
                    totalReports,
                    countryCode,
                    usageType
                ));

                return new XVar(
                    "success", true,
                    "cached", false,
                    "abuseScore", abuseScore,
                    "totalReports", totalReports,
                    "countryCode", countryCode,
                    "usageType", usageType
                );
            }
            catch
            {
                return IpCheckFailure(
                    "Unable to check IP reputation."
                );
            }
        }
    }
}

3. Checking the password from a field event

Open the Register page in Page Designer. Select the password field, open its field events, and add an event that runs when the user leaves the field.

Use the following JavaScript in Client Before:

pageObj.getItemButton("register_save").addClass("disabled");

params["password"] = this.getValue();

if (!params["password"]) {
    return false;
}

In the Server part, add the code for your product.

PHP

$result["count"] = pwnedPasswordCount($params["password"]);

result["count"] = CommonFunctions.PwnedPasswordCount(
    parameters["password"].ToString()
);

Use this JavaScript in Client After:

var count = Number(result.count);

if (count < 0) {
    swal("The password could not be checked. Please try again.");
    return;
}

if (count > 0) {
    swal(
        "This password has appeared in known data breaches "
        + count
        + " times. Please choose another password."
    );
    return;
}

pageObj.getItemButton("register_save").removeClass("disabled");

4. Disabling the Register button when the page loads

Open Events → Global events → Register page → JavaScript OnLoad and disable the ‘Register’ button until the password check succeeds:

pageObj.getItemButton("register_save").addClass("disabled");

register_save is the Item ID of the standard Register button.

5. Enforcing the password check before registration

The field event improves the user experience, but client-side controls can be bypassed. Repeat the check in Events → Global events → Register page → Before registration.

PHP

$count = pwnedPasswordCount($userdata["password"]);

if ($count < 0) {
    $message = "The password could not be checked. Please try again.";
    return false;
}

if ($count > 0) {
    $message = "This password has appeared in known data breaches. "
        . "Please choose another password.";
    return false;
}

return true;

int count = CommonFunctions.PwnedPasswordCount(
    userdata["password"].ToString()
);

if (count < 0)
{
    message = "The password could not be checked. Please try again.";
    return false;
}

if (count > 0)
{
    message = "This password has appeared in known data breaches. "
        + "Please choose another password.";
    return false;
}

return true;

Replace password if your login table uses a different password field name. Field names are case-sensitive.

6. Checking IP reputation in After App Init

Create a free account at abuseipdb.com/register. After signing in, open the account dashboard, select ‘API Settings’, and generate an API v2 key.

Add the following code after the existing code in Events → Global events → After App Init. Replace the placeholder with your API key and keep the real key out of public project exports and source repositories.

PHP

$ipAddress = $_SERVER["REMOTE_ADDR"] ?? "";
$apiKey = "YOUR_ABUSEIPDB_API_KEY";

$ipResult = checkIPReputation($ipAddress, $apiKey);

if (
    $ipResult["success"]
    && $ipResult["abuseScore"] >= 90
) {
    http_response_code(403);
    exit("Access denied.");
}

string ipAddress = HttpContext.Current.Request.UserHostAddress;
string apiKey = "YOUR_ABUSEIPDB_API_KEY";

dynamic ipResult = CommonFunctions.CheckIPReputation(
    ipAddress,
    apiKey
);

if (
    XVar.Pack(ipResult["success"])
    && Convert.ToInt32(ipResult["abuseScore"].ToString()) >= 90
)
{
    HttpContext.Current.Response.StatusCode = 403;
    MVCFunctions.Echo("Access denied.");
    MVCFunctions.Exit();
}

The checkIPReputation() function reuses a cached result for 24 hours. The sample uses the MySQL DATE_SUB() and NOW() functions. Adjust that date expression if your project uses another database.

An AbuseIPDB failure does not block the application. A score of 90 or higher does. Adjust the threshold to match your own security requirements.

If the application runs behind Cloudflare, a load balancer, or another reverse proxy, configure the web server to restore the visitor’s original IP address before this code runs. If the application is accessed directly, no additional configuration is required. Do not read X-Forwarded-For or another forwarding header unless requests to the application can come only through a trusted proxy, because these headers can otherwise be forged.

After rebuilding the project, test registration with a known compromised test password and then with a unique password. Confirm that the server-side registration event still rejects a compromised password if JavaScript is disabled. For the IP check, confirm that the first lookup creates a cache row and subsequent page requests reuse it for 24 hours.

The Pwned Passwords implementation follows the service’s k-anonymity range-search model and uses response padding. See the Pwned Passwords API documentation. See the AbuseIPDB Check endpoint documentation for API-key and response details.

Block Compromised Passwords and High-Risk IP Addresses

1. Creating the IP reputation cache table

2. Adding the reusable security-check functions

3. Checking the password from a field event

4. Disabling the Register button when the page loads

5. Enforcing the password check before registration

6. Checking IP reputation in After App Init

Leave a Reply

Sign up for the free email newsletter for news about our
database publishing software, tips, and more.

Resources

Company

1. Creating the IP reputation cache table

2. Adding the reusable security-check functions

3. Checking the password from a field event

4. Disabling the Register button when the page loads

5. Enforcing the password check before registration

6. Checking IP reputation in After App Init

Related posts:

Leave a Reply