I also have suggestion regarding banned IPs. I concluded that it's better not to block forum posts / main page etc. when an IP is blocked (IP can be shared by many people and some of them may be useful clicking on ads or something ;) So I'd suggest to change this:

to this below (to only ban unlogged users for 'registernew', 'authorize', 'sendirect' actions). That would make the site's content visible to banned IPs and prevent unregisterd abusers from posting (registered users can be blocked manually if needed).

Thanks, this is an interesting suggestion.

But may be then it would be better to prevent just any incoming POST request from the execution? Users from banned IPs certainly should not be allowed to post anything, to login and to perform many other operations beyond those you suggest. Preventing any POST operation would also allow forum being displayed in the read-only mode.

Right, preventing _POST would be the best solution. How to implement it then? : ) Like this: ?

Please check the code below. $_POST is always present in PHP, but is empty if the POST data is not supplied. So the size of this array should be checked. Also, the code should not be executed for the logged admin only. The condition `$user_id==0` is wrong.

I've checked it on my side and it seems it still allows the login. But I suppose, it's not such a big deal, 'cause posting of messages and even updating the profile is not possible. Try on your side and let me know if it would work for you. I may add it in the official release as well, liked the idea of the "soft ban".

It works; yes, user can be logged in but if he cannot do $_POST then that's all that is needed to make the ban work. The only suggestion from me would be to put the $banRes query as last so that there's no unnecessary query if there's no $_POST and adding $isMod, so:

Yes, adding $isMod is also useful, but both these:

should come first. So if the script sees admin or moderator are logged in, it will not check the banned-IPs table at all. I.e. admin/moderator should be skipped from checking initially.

So most likely it could look like this:

OK it works too..