Check user is human with no captcha | |||
|
Many users are put off from adding captcha type programs to their code, either because of the complexities of it or because the PHP installed on their server does not have the image manipulation libraries needed to run it. Here is a simple and easy way from PHP to check that a user is human without having to go through the complexities of Captcha - this is very secure thanks to the miracles of MD5 (a non-reversible hashing algorithm) which unlike GD or Imagemagick is part of every PHP installation. Here is the basic code: PHP code to check a user is humanHere is how the code to stop those pesky bots works. I will show you how to add this into your application (whether its zend encoded black box code or something you control) in a moment. Function areyouhuman builds a simple arithmetical question, adding or subtracting a random number between 1 and 190 from/to a random number between 200 and 10200. It then adds a magic number to the expected answer and stores a hidden variable in the form with md5 encoding. This special encryption cannot be reversed (well it can if you have 21 days and a network of playstation 3's working on it) but will always be the same for any given input string. This means that the bot cannot simply pluck and answer from a hidden form field and return it. Above we have set the value $hum to the HTML that is returned by the areyouhuman routine. Here what the output from $hum looks like:
Function checkhum gets the values back from POST that we are interested in - just the answer($ansin) and the expected md5 if its correct ($hans) it adds the magic number to the answer and MD5 encodes it. Now if the answer is the one we are expecting then both md5's will be the same. If they are not we kill the script and stop the bot stone dead (a human can just press the back button and try again!). Please note this is not 100% secure since a programmmer could grab the maths off the page, work out the answer and send the right one, however nobody is doing this yet. A more secure way would be to use a set of images of numbers and the +/- signs - just remember not to number them 1.jpg 2.jpg etc! Now how to use the code. If its a form/script you encode then its easy.
How to use the Captcha Replacement/alternative in your codeIf we assume you have saved the above code as checkhum-inc.php....
The above is a simple registration form example. We check the post array to see if its a return from the form or we are simply displaying the page, print displays the page including a message ($msg) and our humanity check ($hum). The result calls our page again (form handily does that if you leave the target out) this time it knows from the button return (and this is how you can process multiple submit buttons on a form) that the registration is requested. We wait 5 seconds (this stops a bot from pounding the script with guesses ten thousand times a second), check to make sure the sender is human (remember the checkhum routine terminates the script if it is a bot) validate the email address and register/redirect if its good or send a message back and redisplay the form if its bad. Now if you are working on a zend encoded or encrypted script that you cannot alter, or do not wish to alter then you can usually still use this technique. Run the script to get its form up on the screen and view the HTML source. Cut and paste this into a new html or php file as needed. Do a similar exercise to the above but if it passes the human test then send the variables (except the ishuman ones!) to the original script using POST from php. Here is how to do that...sigh.
This will give you in $response whatever the old script would have sent back to the user (probably an html page saying its all ok or you screwed up). You can if you want display this to the user or parse it for any message and just show them that. Phew! All done. So now you know how to check for input from a human being without captcha!
You are welcome to use any or all of this code. A link back would be nice!
|
Useful Pages
PHP Unique Filename Referrersbookmark hitwww.google.it www.google.co.za internal hit www.google.com www.google.com.hk www.google.co.uk vidvain.com yandex.ua www.google.be ... www.google.ca ... www.pressmap.de ozinengland.com ... www.google.co.in www.google.com.ua www.prbd.net www.google.com.au ecashhyip.com www.google.hr www.google.nl www.google.com.pk thealkalinediet.org ... www.upvery.com baerbykes.com www.press-release.in landroidapps.com www.google.com.br ... www.google.dk www.babadorie.net ... www.google.pl www.onlineprnews.com www.google.com.np www.google.se isearch.avg.com www.havas.rybnik.pl www.google.pt www.google.co.th www.google.ru ... This list of people who link to this useful page is automagically maintained. Link to us, send traffic, and get listed. Simple.
|
||