Entering recaptcha only once on form validation fa

问题:

I have a form which has a few fields and a recaptcha code at the end.

When the user submits the form, the recaptcha field is validated along with the other fields on server side (PHP). If the any of the fields are invalid, the user is redirected to the same form with errors.

However, the problem is : The user has to enter the recatpcha again.

Is there any way I can NOT ask the user to enter the recaptcha again if the form validation fails but captcha validation is successful ?

回答1:

Sure there is. You could store the validation success of the recaptcha into the session (or a cookie, or a database) and then hide the recaptcha if the indication is there. On the serverside you simply have to check if either the recaptcha is correct or the indication is valid.

You also have to make sure that a valid recaptcha cookie can only be used once, because if not the spammer can simply sent the cookie information over and over again and work around the recaptcha.

My idea is to store a timestamp within the session under a key like "recaptcha_success" and then check if the timestamp is not older than a few minutes (whatever fits your needs). If it's not, work around the recaptcha by not validating it again. If the form is valid, remove the key so the next time the user wants to use the form he has to enter the recaptcha again.

回答2:

Without seeing your code or how it's set up exactly the simplest thing I can think of is to use a PHP session:

File that receives form data (assumed POST)

session_start();

foreach($_POST as $key=>$val)
{
   if($key == "captcha" || $_SESSION['captcha_valid'] != 1)
   {
      //validate captcha
      if(captcha is valid)
      {
         $_SESSION['captcha_valid'] = 1;
      }
    }
 }

File that contains the form

  session_start();

echo "<form method='yourphpfile.php' method='post'>"

    if(!isset($_SESSION['captcha_valid']) || $_SESSION['captcha_valid'] != 1)
    {
       //add captcha code
    }

</form>

回答3:

Yes - set the session variable that captcha was entered successfully and don't display recaptcha form.

回答4:

you can verify by setting session var like this

<?php
// captcha is already submitted so no need to verify again,
if(!isset($_SESSION['human_signup']) || (time() - $_SESSION['human_signup'] > 300)){

    require_once('admin/recaptcha/recaptchalib.php');

    // Get a key from https://www.google.com/recaptcha/admin/create
    $publickey = 'your publickey';
    $privatekey = 'your privatekey';


    # the response from reCAPTCHA
    $resp = null;

    $resp = recaptcha_check_answer ($privatekey,
                                $_SERVER["REMOTE_ADDR"],
                                $_POST["recaptcha_challenge_field"],
                                $_POST["recaptcha_response_field"]);

    if (!$resp->is_valid) {
    // What happens when the CAPTCHA was entered incorrectly 
    $errors[] = 'The CAPTCHA wasn\'t entered correctly, please try again';
    }else{
    $_SESSION['human_signup'] = time();
    $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
    }
}

and then on html form do something like this to show captcha form.

<?php
 if (!isset($_SESSION['human_signup']) || (time() - $_SESSION['human_signup'] > 300)){ ?>
<label class="control-label">CAPTCHA</label>
<script type="text/javascript"> var RecaptchaOptions = {theme : 'white' }; </script>
<script type="text/javascript" src="http://www.google.com/recaptcha/api/challenge?k=your key"></script>
  <noscript>
     <iframe src="http://www.google.com/recaptcha/api/noscript?k=your key"
         height="300" width="500" frameborder="0"></iframe><br>
     <textarea name="recaptcha_challenge_field" rows="3" cols="40">
     </textarea>
     <input type="hidden" name="recaptcha_response_field"
         value="manual_challenge">
  </noscript>
<? } ?> 

Make sure you remove the session once user registration is complete. like this.

<?php
//insert registration data in db i.e. registration is complete.
//unset the session used to hide the captcha.   
unset($_SESSION['human_signup']); 
?>

One less important feature to block user to input captcha manually and then using some script to automatically create accounts.

/* if user tries to  register automatically by manually entering captcha and using scrpt to create accoutns */
<?php
if(isset($_SESSION['human_signup']) && ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT'])) {
    unset($_SESSION['human_signup']);
    unset($_SESSION['user_agent']);
@session_destroy();
@session_unset();
}
?>

hope this helps., if i missed something , please feel free to edit answer.