Simple PHP math captcha to minimize bots sending you junky emails?

**PicnicTutorials** · Dec 28, 2012 19:57

@ScallioXTX hey thanks a lot for the alternate method! While your solution does seem to be more secure for the reasons mentioned is it necessarily needed? My thought is JS is basically only used to give hints to the user and etc. And the php backend ultimately protects from spambots and such? So my thought is (maybe I'm wrong?) is that js gives the user hints and makes it pretty while php makes it secure. So if thats the case, if a bot can read the JS captcha, can it therefore also read the mirrored php captcha? Maybe I'm totally off base - if so feel free to let me know.

I am in no way opposed to your method if the above statement is untrue. In which case I just need clarification on where to place said code. The post.php and the validation-captcha.php are identical aside from one line. Is that by design I assume? AND do both snippets go in my formmail.php (aka the php that processes the form)?. If so does order matter? Thanks for your thoughts

**ScallioXTX** · Dec 29, 2012 03:10

Originally Posted by EricWatson

@ScallioXTX hey thanks a lot for the alternate method! While your solution does seem to be more secure for the reasons mentioned is it necessarily needed? My thought is JS is basically only used to give hints to the user and etc. And the php backend ultimately protects from spambots and such? So my thought is (maybe I'm wrong?) is that js gives the user hints and makes it pretty while php makes it secure. So if thats the case, if a bot can read the JS captcha, can it therefore also read the mirrored php captcha? Maybe I'm totally off base - if so feel free to let me know.

The main difference is that in the JS only version the answer is encoded in the page. So all a spam bot needs to do is fetch that answer and post it with the rest of the form. They only need to figure out first it needs to be multiplied by 2, which is quite easy to find out since it says so in the JS.
In my variant the answer is known by PHP and PHP only (although parsing a simple math question is also quite easy for hackers, but that aside). Tje JS still makes it pretty by sending the answer to the server after it's filled to see if the given answer is correct.

Originally Posted by EricWatson

I am in no way opposed to your method if the above statement is untrue. In which case I just need clarification on where to place said code. The post.php and the validation-captcha.php are identical aside from one line. Is that by design I assume? AND do both snippets go in my formmail.php (aka the php that processes the form)?. If so does order matter? Thanks for your thoughts

Yes, that is by design.

post.php checks if the posted values are correct; this is the part that goes in your formmail.php.
validate-captcha.php is called by the bassistance validation plugin to see if the entered value is correct and returns either an error message which the bassistance plugin will then show the user, or the text "true", indicating to the bassistance plugin the user entered the correct value. No need to put this one in your formmail.php too; this is just a simple stand alone script for the bassistance validation interaction.

**Pullo** · Dec 29, 2012 03:16

Originally Posted by ScallioXTX

So all a spam bot needs to do is fetch that answer and post it with the rest of the form. They only need to figure out first it needs to be multiplied by 2, which is quite easy to find out since it says so in the JS.

This is a fascinating subject and something that I have been wondering throughout this thread: do you think that your average bot is in a position to do this?
Do you have any idea or insight about the level of "intelligence" one could attribute to a bot?
I would have thought that it would have been easier for a bot to eval any maths questions they encountered (which would render the whole process futile anyway).

**ScallioXTX** · Dec 29, 2012 04:17

Originally Posted by Pullo

This is a fascinating subject and something that I have been wondering throughout this thread: do you think that your average bot is in a position to do this?
Do you have any idea or insight about the level of "intelligence" one could attribute to a bot?
I would have thought that it would have been easier for a bot to eval any maths questions they encountered (which would render the whole process futile anyway).

The average bot is stupid as crap. All they see is some form on a page which they will then fill out by guessing what each field is for. But I can well imagine that some people are scavenging the internet for forms they can abuse, find out how they work, write a script (or rather, customise one they've lying around that already fits quite well) and run it, spamming the form without end. If the answer to hacking the captcha is in the JS this is of course dead simple. Indeed, in this case letting the script fetch the page first, scrape the sum of it, calculate it, and send it with the form isn't much harder. Indeed, this theory applies more to "real" captchas (ie, random strings) than to simple math. Another option would be to ask questions like "What color is the sky?", or show an image and ask the user to click the white cat, stuff like that. When the answer is server side, there is nothing the hacker can do but to work out all different questions and answers, which is time consuming so he'll probably just mosey on to the next form he can get his greasy fingers on.

This is also an interesting read on the subject: http://nedbatchelder.com/text/stopbots.html

**PicnicTutorials** · Dec 29, 2012 06:19

Thank you very much for the detailed answer ScallioXTX

I will most likely use your method as it is more secure and therefore better for its intended purpose.

However, my read on what bots are capable of or not tells me that "probably" 99.5% of the time the extra measure is not necessary. I personally don't think bots are going to scour the code to put all the pieces together to figure out the captcha. In fact, I think they simply click Submit and move on not knowing if it was successful or not. That being today in 2012/2013. However, year 2015-2020 may tell a different story. Bots will inevitably get more sufisticated. In the future they will be able to put the pieces together. Although capable or not, the whole point to the captcha is security so one mine as well go the more secure route.

Thanks a lot guys! With your input this thread is invaluable.

**PicnicTutorials** · Dec 29, 2012 08:10

@ScallioXTX or @Pullo bugger, I'm having a bit of trouble accurately putting all the pieces together with my script. MY SCRIPT, and accompanying JS need to do the following... The on page JS (or Ajax?) need to show no messages only display the red blinking outline. No incorrect answer, correct answer, or required field. And then on the php side if there is an error it needs to go to the error-page.php, and if successfully needs to go to confirmation-page.php.

I'm on vacation so only have access to my iPad. I tend to miss the obvious on my iPad sometimes. But I messed with it for we'll over an hour and couldn't seem to get all the pieces to work correctly. Anyway you can work that up for me so that it works the way I originally intended? Thank a lot!

Here is my formmail script again http://www.visibilityinherit.com/projects/formmail.txt
And here is the test page http://www.visibilityinherit.com/projects/formtest.php

PS I appreciate how the numbers are completely random - that's cool. And also a little something I noticed (maybe it was just the way I had it) after submitting if going back and trying to submit again the captcha would just say incorrect answer even though it was correct. Probably a moot issue.

**ScallioXTX** · Dec 30, 2012 10:51

See attached. Tried and tested. Works

**PicnicTutorials** · Dec 30, 2012 14:16

Amazing.

Thank you very much! Now that I'm back to my dinosaur computer I should be able to follow it. Thanks a ton. I'll post back with my results...

**PicnicTutorials** · Dec 31, 2012 08:09

I'm sorry to come back again, but is there a way to have the option to display messages as I had it before? Before I just used a blank value in order to show no messages. And if I wanted to just put a value in. Like...

Code JavaScript:

<script type="text/javascript">
/* Fire Valaidate */
$(document).ready(function(){
		$.validator.addMethod("nourl", 
                    function(value, element) {
                         return !/http\:\/\/|www\.|link\=|url\=/.test(value);
                        }, 
                        "No URL's"
      );
$("form").validate({
				rules: {
					name: {
					required: true
					},
					email: {
					required: true,
					email: true
					},
					comments: {
					required: true,
					minlength: 5,
					nourl: true
					},
					spam: {
					required: true
					}
				},
				messages: {
					name: "",
					email: "",
					comments: "",
					spam: ""
				}
		  });				
	});
</script>

I'll keep messing with it but I havn't been able to crack it.

**ScallioXTX** · Dec 31, 2012 08:21

Originally Posted by EricWatson

I'll keep messing with it but I havn't been able to crack it.

Me neither, which is why I just added to function to suppress everything.
Here is a good demo of what you can do with custom messages, maybe that helps? http://jquery.bassistance.de/validate/demo/milk/

**PicnicTutorials** · Dec 31, 2012 08:24

Thanks! I thought just adding that function on the spam would do it - no apparently

**PicnicTutorials** · Dec 31, 2012 08:39

Cracked it! Thats why I couldnt because I was using my iPad before with no firebug able to change rules so I got focus on the js side. Before I just fed the error display inline verses none so I didnt have to say !important (which is a sign of failer to me). Display none fixes it. So now it gives the option to give messages if so wish.

Code CSS:

label.error {
display:none !important;
}

Code JavaScript:

<script type="text/javascript">
/* Fire Valaidate */
$(document).ready(function(){
		$.validator.addMethod("nourl", 
                    function(value, element) {
                         return !/http\:\/\/|www\.|link\=|url\=/.test(value);
                        }, 
                        "No URL's"
      );
$("form").validate({
				rules: {
					name: {
					required: true
					},
					email: {
					required: true,
					email: true
					},
					comments: {
					required: true,
					minlength: 5,
					nourl: true
					},
					spam: {
					required: true,
					remote: {
          			url: "validate-captcha.php",
          			type: "post",
       				 }
					}
				},
				messages: {
					name: "",
					email: "",
					comments: "",
					spam: ""
				}
		  });				
	});
</script>

**PicnicTutorials** · Dec 31, 2012 09:44

Man I could almost go eat. Anybody have any any idea why it's not working in IE8? I don't have ie9 so I can't see it there. It just bypasses the js altogether. Works perfect in good browsers. Here is the live test page taken strait from the zip above. http://www.visibilityinherit.com/pro...t/formmail.php. If whomever needs to see the php just download the zip. Thanks!

**PicnicTutorials** · Dec 31, 2012 10:21

If I go back to jquery v1.3.2 then ie8 works without the remote stuff. seen here http://www.visibilityinherit.com/cod...ation-demo.php. If I use the most recent version of jquery then regardless if I use remote or not it doesnt work in ie8?

**PicnicTutorials** · Dec 31, 2012 16:30

OK! narrowing it down here. But I think I reached my limit. Here his captcha works in ie8 http://jquery.bassistance.de/validat...tcha/index.php. He is using jquery v1.3.2 and validation plugin v1.10.0

Here I have setup my test page of his setup http://www.visibilityinherit.com/pro...t/formmail.php. It almost works except the captcha doesnt validate correctly. Put in the correct answer and it sees the wrong etc.

Thanks for any help!

**PicnicTutorials** · Jan 1, 2013 10:33

ok here is a stripped down test page working in all but ie8 with the latest jquery and jquery validation plugin http://www.visibilityinherit.com/projects/test/test.php.

**Pullo** · Jan 1, 2013 13:31

Hi Eric,

The test page you provide works for me in IE8.
The question I got was 2+5. If I enter anything other that 7, focus is drawn back to the input box.
If I enter 7, then the form submits to /projects/test/formtestformmail.php, which is a 404.

However, if I change to IE7, I can bypass the validation altogether.
Even if I enter "Father Christmas" into the field, then the form still submits to /projects/test/formtestformmail.php.

Did you mix the version numbers up, or have I found a new bug?

**Pullo** · Jan 1, 2013 13:37

Hey,

I just found out why it's crashing in IE7.

This is your validate function:

Code JavaScript:

$("form").validate({
  rules: {
    name: {
      required: true
    },
    email: {
      required: true,
      email: true
    },
    comments: {
      required: true,
      minlength: 5,
      nourl: true
    },
    spam: {
      required: true,
      remote: {
        url: "validate-captcha.php",
        type: "post",
      }
    }
  },
  messages: {
    name: "",
    email: "",
    comments: "",
    spam: ""
  }
});

If you look at the spam section you have:

Code JavaScript:

type: "post",

This should be:

Code JavaScript:

type: "post"

without the trailing comma.

It's weird that this makes IE7 crash, as it's such a good browser otherwise ...

**PicnicTutorials** · Jan 1, 2013 14:51

What the heck! I've been testing this thing for hours both live and via local Wamp. I guess this combo of scripts works in ie8 and I failed to test it live. Because live your right it does work but locally in wamp it doesnt. I guess thats why I missed it. Well thanks again Pullo. You set me back on path again. Hopefully it works the same when I add it back to the full page. Happy new years

**PicnicTutorials** · Jan 1, 2013 17:28

Wow too many pieces to put together. I finally got it all working I believe. Thanks again guys!

**Bonty6954** · Apr 5, 2013 05:46

Originally Posted by EricWatson

Wow too many pieces to put together. I finally got it all working I believe. Thanks again guys!

The one with pieces I think is too much for users.

Because it takes time and user may navigate away from website

I am trying to make a arithmetic text based captcha using the tutorial below

http://www.bestwebsitesdesigner.com/...ite/#more-1319

I have almost got it set up but from above quotes it seems that it is not going to work?

Though it has a java script and if bots disables java script can they send the spam emails even if they don't answer the question.

If java script is disable what kind of captcha will work. Isn't there any simple captcha which does not need a java script.

Any simple way to do this with perfect solution please?

Thanks

**Pullo** · Apr 5, 2013 05:51

Originally Posted by Bonty6954

I have almost got it set up but from above quotes it seems that it is not going to work?

Nah, it'll work because of step 5.
The script relies on JS validation for humans, but still catches incorrect submissions server side.

Originally Posted by Bonty6954

If java script is disable what kind of captcha will work.

Any captcha which relies on server side validation.
This is something the bots cannot easily bypass.

User Tag List

Thread: Simple PHP math captcha to minimize bots sending you junky emails?

Thread Tools

Display

Bookmarks

Bookmarks

Posting Permissions