Say that I have a user account system on my website. When I enter a username and password, it just checks it against a database using prepared statements. If the user tries to login more than once per 10 seconds, they are locked out for 10 minutes.
Most (even the simplest) login scripts I've seen feature more security than this, though I haven't looked at it in detail. What else would be necessary for a secure system? I've got brute force and SQL injection covered, what else is there?
Sorry for such a naive question, I'm new in the web development/security field.