Re: Quickform CAPTCHA

On 12/8/06, David L <david-newsphp@ackee.com> wrote:

Thats just it. I don't see any possible way to regenerate the captcha upon validation error alone. Thing is whenever the form is submitted the captcha will regenerate thus changing the session var and causing the captcha check to fail. Again the rule fails because it occurs during the validation check which occurs after the form has been reloaded.

So don't do that. Check if the session var is set and don't regenerate. Use the saved captcha text.

I am not sure if what I want to do is possible here. The problem lies in the setDefaults area, which calls the captcha function upon form load. Should the setDefaults be applied again when the form is submitted? Can we somehow control the setting of the session var beyond saving it if it is already set?

This is just a question of logic. You just have to run things at the right time. Actually, you should be perfectly fine only calling setDefaults if validation doesn't happen. The defaults don't have anything to do with the submitted values, really.

Thanks. Justin Patrin wrote: On 12/8/06, David L <david-newsphp@ackee.com> wrote:

Hoping someone can help. I am implementing a simple CAPTCHA for my forms but have come across a sticky problem. The relevant "abbreviated" code is shown below. The problem I am facing is in verifying the CAPTCHA. When the form initially loads a random image is generated by captchaImage() and sets the default for captcha_image, and sets the value of $_SESSION['register_captcha']. Then whenever the form is submitted to be validated the captcha function regenerates $_SESSION['register_captcha'] and the image, but before the checkCaptcha rule is verified. I believe this occurs because as the form reloads, quickform reads the form first and sets the defaults again (regenerating the CAPTCHA), and then validates the form which checks the rules. Sort of a chicken and egg problem. I could work around this by checking if $_SESSION['register_captcha'] is set and using the value, but then wouldn't be better if validation fails to regenerated the CAPTCHA, rather than reusing. e.g. credit: http://www.phpjabbers.com/captcha-image-verification-php19.html

        if(!isset($_SESSION["register_captcha"])) {
            $text = rand(100000,999999);
            $_SESSION["register_captcha"] = $text;
        } else {
            $text = $_SESSION["register_captcha"];
        }

//captcha image generation, credit: http://www.phpjabbers.com/captcha-image-verification-php19.html

If you really want to regenerate on validation failure I suggest you do just that. Don't regenerate if the session value is set, then if validation fails unset the session var and regenerate.

-- Justin Patrin