c# - Blocking a user in ASP.NET using timeout -

i trying make login page using asp.net. want block user 5 minutes after 3 failed login attempts. didn't use login control in page,so guess can't use membership provider. want following:

• set counter 0 , bool called accept_login true
• every time validatepassword function returns 0,the counter increments
• when counter's value 3, set accept_login on false,reset counter , start timeout 5 minutes

below code wrote without implementing these things. me integrate them? thanks!

    using system;     using system.collections.generic;     using system.linq;     using system.web;     using system.web.ui;     using system.web.ui.webcontrols;     using system.data.sqlclient;     using system.configuration;     using system.data;     using bcryptlibrary;     using system.web.security;      namespace bootstrapregisterlogin     {         public partial class login : system.web.ui.page         {             protected void page_load(object sender, eventargs e)             {              }              protected void button1_click(object sender, eventargs e)             {                  string cs = configurationmanager.connectionstrings["mydatabaseconectionstring1"].connectionstring;                 using (sqlconnection con = new sqlconnection(cs))                 {                      using (sqlcommand verifica = new sqlcommand())                     {                           con.open();                         verifica.commandtext = "select * [users] username=@nume_ut";                         verifica.parameters.add("@nume_ut", username.text);                         verifica.connection = con;                         verifica.executenonquery();                          using (sqldatareader rd = verifica.executereader())                         {                             while (rd.read())                             {                                 if (hasher.validatepassword(password.text, rd[2].tostring()))                                 {                                     con.close();                                     sqldataadapter sda = new sqldataadapter(verifica);                                     datatable dt = new datatable();                                     sda.fill(dt);                                      if (dt.rows.count != 0)                                     {                                          string utype;                                         utype = dt.rows[0][6].tostring().trim();                                                                           if (utype == "u")                                         {                                             session["username"] = username.text;                                             response.redirect("~/userhome.aspx");                                          }                                          if (utype == "a")                                         {                                             session["username"] = username.text;                                             response.redirect("~/adminhome.aspx");                                         }                                      }                                  }                                 else                                 {                                      lblerror.text = "username sau parola invalide";                                   }                                  }                              }                          }                     }                 }             }         }