script Secure capcha script

[Android404]

Heres a little script that I've been working on.

It's basically a capcha script.

It uses the base64 encryption to hide the image code from spam bots.
And also because spam bots reads your source, i included a little hidden checkbox which many of them
would click anyway.

They will then be redirected to they're localhost, and it will also be logged that the bot has been there.
You will have to work around with my code to implement it on your websites if you wish too.

But please, do not use any of my work on websites containing adult content.

==========
Also a word of thanks to Gumslone for giving me the idea, and leading me in the right path of encoding some stuff.

Here you go, and enjoy guys.

Quintin

[something else]

base64 isn't safe from bots - gums way he advised is a better way of doing it by making a unique encryption

[GumSlone]

for encoding and decoding you could use this functions: http://coding-talk.com/forum/main-fo...8233#post48233

[just_m3.]

The best way to implement captcha is to set the text to draw and & the answer within the captcha file set the "answer" as session in captcha and verify user input / post data against the captcha session on the file you are verifying data, this way you don't need to put answer in source and is more safe , so no need to encode the captcha answer in order to verify it since you have it as session on server side.

Setup random captcha background color codes so if they use any ocr recognize scripts won't be easy to catch the answer .



Here's my captcha

<?php
session_start();

$number1 = mt_rand(10, 40);
$number2 = mt_rand(1, 10);
$sign = mt_rand(1, 2);

if ($sign == 1) {
    $rep = $number1 + $number2;
    $string = "$number1 + $number2 = ";
} else {
    $rep = $number1 - $number2;
    $string = "$number1 - $number2 = ";
}

$_SESSION['check_login'] = $rep;

$im = imagecreate(130, 30);



$bg = imagecolorallocate($im, mt_rand('150', '250'), mt_rand('120', '250'), mt_rand('10', '250'));

$textcolor = imagecolorallocate($im, 0, 0, 0);

$font = '/fonts/Candice.ttf';

imagettftext($im, 22, 0, 10, 20, $textcolor, $font, $string);

for ($c = 0; $c < 200; $c++) {
    $x = rand(0, 200 - 1);
    $y = rand(0, 30 - 1);
    imagesetpixel($im, $x, $y, $textcolor);
}

header('Content-type: image/png');

imagepng($im);
imagedestroy($im);
?>

Preview:



And check it like this :

<?php
    if($_POST['form-captcha'] != $_SESSION['check_login'] ){

         if(isset($_SESSION['login_error'])){unset($_SESSION['login_error']);}

         $_SESSION['login_error'] = "
         <span class='error_login_msg'>
         Error : Answer is not matching captcha !
         </span>";
        
         header('Location: ' . $address . '/login.php');
         exit;
    }
?>

On login.php display error :

<?php echo $_SESSION['login_error'] ; ?>

[frostymarvelous]

The best way to implement captcha is https://developers.google.com/recaptcha/intro
It is free. Why reinvent the wheel with a clunky solution that wouldn't be that great anyway?

[something else]

Why reinvent the wheel with a clunky solution that wouldn't be that great anyway?

Because if no one tried reinventing wheels, we would be stuck with wooden wheels on our cars....
Non metaphorical: If we all jumped straight to the "best way" then no new "better way" would be made (other than who is working on the original). Yes they may be clunky but the main thing is other ways are being explored.

+ Also you may not want to be sending user data to google

[frostymarvelous]

Your argument is fallacious.
Captcha is like Crypto and Auth. You don't want to roll your own. You want to use a tried and trusted solution.
You use the best way and work on a better way that is at least as good as the best way.
You don't go back to using captcha techniques that we used back in 2008 that no longer work.

It is great to learn how to do these things, especially as a learning experience. But to assume that you are going to best some of the best engineers in the world with rudimentary techniques is...

+ I guess you don't use analytics, google search, chrome or android. Google already owns all user data. Get used to it.

[something else]

[sarcasm]
Oh I understand now:
If someone makes the best (door lock/Operating system/[insert your word(s) here]) in the world, no one else should ever try to make a different one.
We shouldn't experiment and find out what works and what doesn't for ourself's. We should believe everything that is wrote on text books/internet and not try to break the moulds.
It Makes perfect sense now.

+ Yes I definitely mentioned myself. Yes Google owns all user data
[/sarcasm]

As for this topic, I'm done here, I come here to help others with there coding's, not to get into silly debates over "the best way".

Peace out.

[frostymarvelous]

[facepalm]

[kevk3v]

I think for captchas using ReCaptcha would always turn out better atm. It doesn't mean you can't try to re-invent something else.
ReCaptcha has a proven record and is better than almost every other solution at detecting bots/spam.

[Ghost]

try to re-invent something else.

why whats wrong with him LOL

[subzero]

<?php
// Set the content-type
header('Content-Type: image/png');

// Create the image
$im = imagecreatetruecolor(70, 30);
// Create some colors
$white = imagecolorallocate($im, 255, 255, 255);
$grey = imagecolorallocate($im, 128, 128, 128);
$black = imagecolorallocate($im, 0, 0, 0);
imagefilledrectangle($im, 0, 0, 399, 29, $white);

// The text to draw
$text = base64_decode($_GET['text']);
// Replace path by your own font path
$font = 'georgia.ttf';


// Add the text
imagettftext($im, 20, 0, 10, 20, $black, $font, $text);

// Using imagepng() results in clearer text compared with imagejpeg()
imagepng($im);
imagedestroy($im);
?>

I would do

<?php
// Set the content-type
header('Content-Type: image/png');

// Create the image
$im = imagecreatetruecolor(70, 30);
// Create some colors
$white = imagecolorallocate($im, 255, 255, 255);
$grey = imagecolorallocate($im, 128, 128, 128);
$black = imagecolorallocate($im, 0, 0, 0);
imagefilledrectangle($im, 0, 0, 399, 29, $white);

// The text to draw
$text = rand();
// Replace path by your own font path
$font = 'georgia.ttf';


// Add the text
imagettftext($im, 20, 0, 10, 20, $black, $font, $text);

// Using imagepng() results in clearer text compared with imagejpeg()
imagepng($im);
imagedestroy($im);
?>

If none numbers mix..