Need helpful advice for form verification

wannabe85

Hi, I am totally new to php programming, but somehow, with a little fiddling, I managed to create a contact form that actually works!

However, I got a bit too ambitious and thought I could also simply add a CAPTCHA verification field with sound etc., the whole lot. But I messed up my code completely and it really made my head hurt. So I got my backup file out and I am back to square one now.

Can someone please give me a bit of info about how exactly the php captcha script works and how i could implement it in my existing form/page?

In case it helps: I have a html contact page which directs to a php page that spits out which required fields haven´t been filled in and let's the user try again instantly without going back to the html contact form.

Hope anyone can bring light into my pitch black dark.

etully

In the PHP page where you display your captcha, generate a random string of 20 letters and numbers. Now write that string to a database with the answer to the captcha. Embed the random string in the form as a hidden field.

On the next page, after the user hits submit, take his answer and the random string and check the database to see if there are any entries that contain the random string and his answer. If so, then he got the captcha right. Else, display an error message and a new captcha.

dagon

etully;10911323 wrote:
Embed the random string in the form as a hidden field.

Bad idea, could be grabbed by bot, should use a session, or encrypt it if you have to put it in the form.

etully

Dagon: I am beginning to suspect that you don't read my posts before you comment on them.

dagon

I'm begging to suspect your right, but don't fell bad, i apply the same slack thought process to most forum posts.

djjjozsi

Can someone please give me a bit of info about how exactly the php captcha script works and how i could implement it in my existing form/page?

in nutshell:
CAPTCHA style image activation image security:
usually creates an image, generates a random string (numbers and letters) 6-10 characters and a noisy background image in a server side program for example: CaptchaSecurityImages.php The code usually stored in SESSION variable, for example: $_SESSION["security_number"]

On the process page you can re-call this security number from session.

if this $SESSION["security_number"] is not equal with the $POST -ed activation_code then you block that comment/registration/login or whatever you want.

And you can embed this image in html if you're using the <img> html tags.

<img src="CaptchaSecurityImages.php" />
Security Code: 
<input id="security_code" name="security_code" type="text" />

wannabe85

Cheers guys!

I will have a good go at it over the weekend. Hope it works this time. Everything is becoming a bit clearer now.

At least I have a slight idea now where I might have gone wrong.

Thanks for your help. Will keep you updated if it worked or not.

wannabe85

hmmm, so I had a go at my verification script again and it didn't quite work out the way I wanted. I created my form html, my enquiry php and my captcha php, but I encountered several problems:

My image doesn't get displayed.
if every required field is filled in, and the captcha code is wrong, it shows a white page.
Can't test what happens if the verification code is correct, as I can't see the freaking image

The only thing that goes right is that when i don't type in anything the enquiry.php tells me that I need to type in the required fields and the verification code.

Does anyone have an idea what I did wrong?

djjjozsi

you can see the result if you type the image.php to the browser, and watch what is the error message.