@Override
    public String grantLogin(User user) {
        String command = "SELECT * FROM secure.USER WHERE US_USERNAME='"+user.getUsername()+"'"
                + " AND US_PASSWORD_MD5='"+Util.calculateMD5(user.getPassword())+"'";
        
        try {
            Connection connection = Util.connectToMySql();
            Statement statement = connection.createStatement();
            ResultSet result = statement.executeQuery(command);        

            if(result.next()) {
                if(result.getString("US_STATUS").equals(Util.BLOCKED_STATUS)) {
                    return Util.MESSAGE_BLOCKED;
                }
                
                command = "UPDATE secure.USER SET US_ATTEMPT = 0"
                        + " WHERE US_ID="+result.getInt("US_ID");
                statement.execute(command);
                
                connection.close();
                return Util.MESSAGE_GRANTED;
            }
            else {
                command = "SELECT * FROM secure.USER WHERE US_USERNAME='"+user.getUsername()+"'";
                result = statement.executeQuery(command);
                
                if(result.next()) {
                    int userId = result.getInt("US_ID");
                    int userAttempts = result.getInt("US_ATTEMPT");
                    String userStatus = result.getString("US_STATUS");
                    
                    if(!userStatus.equals(Util.BLOCKED_STATUS)) {
                        command = "UPDATE secure.USER SET US_ATTEMPT="+(userAttempts+1)
                                + " WHERE US_ID="+userId;
                        statement.execute(command);

                        command = "UPDATE secure.USER SET US_STATUS='"+Util.BLOCKED_STATUS+"'"
                                + "WHERE US_ATTEMPT = 3 AND US_ID="+userId;
                        statement.execute(command);
                    }
                }
                
                connection.close();
            }
        } catch (SQLException ex) {
            Logger.getLogger(UserDAOSql.class.getName()).log(Level.SEVERE, null, ex);
        }
        return Util.MESSAGE_WRONG;
    }