Simple human verification code.

[CrackFeed.Com]

I hate captcha and I am sure you do to. Here is an alternative that is abit more fun, to me at least.

Put this into a file named whatever.php:

$randnum = mt_rand(1,25);
switch($randnum)
 {
    case 1:
      	$botq = 'What is 5 + 3?';
      	$bota = '8';
       break;
    case 2:
	$botq = 'What is 3 + 2?';
      	$bota = '5';
       break;
    case 3:
	$botq = 'What is 5 + 5?';
      	$bota = '10';
       break;
    case 4:
	$botq = 'What is 2 + 7?';
      	$bota = '9';
       break;
    case 5:
	$botq = 'What color is a lemon?';
      	$bota = 'yellow';
       break;
    case 6:
	$botq = 'What is 5 + 1?';
      	$bota = '6';
       break;
    case 7:
	$botq = 'What is 7 + 7?';
      	$bota = '14';
       break;
    case 8:
	$botq = 'What is 8 + 8?';
      	$bota = '16';
       break;
    case 9:
	$botq = 'What shape has no corners?';
      	$bota = 'circle';
       break;
    case 10:
	$botq = 'What is 6 + 6?';
      	$bota = '12';
       break;
    case 11:
	$botq = 'What is 5 x 3?';
      	$bota = '15';
       break;
    case 12:
	$botq = 'What is 16 + 2?';
      	$bota = '18';
       break;
    case 13:
	$botq = 'What is 20 + 25?';
      	$bota = '45';
       break;
    case 14:
	$botq = 'What is 16 + 4?';
      	$bota = '20';
       break;
    case 15:
	$botq = 'What is 9 + 1?';
      	$bota = '10';
       break;
    case 16:
	$botq = 'What is 7 x 3?';
      	$bota = '21';
       break;
    case 17:
	$botq = 'What is 7 + 7 + 1?';
      	$bota = '15';
       break;
    case 18:
	$botq = 'What is 13 + 3?';
      	$bota = '16';
       break;
    case 19:
	$botq = 'What color is a banana?';
      	$bota = 'yellow';
       break;
    case 20:
	$botq = 'What is 15 - 5?';
      	$bota = '10';
       break;
    case 21:
	$botq = 'Are you a bot?';
      	$bota = 'no';
       break;
    case 22:
	$botq = 'Are you a cylon?';
      	$bota = 'no';
       break;
    case 23:
	$botq = 'Are you from mars?';
      	$bota = 'no';
       break;
    case 24:
	$botq = 'Is Earth a cube?';
      	$bota = 'no';
       break;
    case 25:
	$botq = 'Can pigeons fly?';
      	$bota = 'yes';
       break;
}

Ok, now to the form portion. make sure that your script has session_start() at the top of it and call this before your form starts:

	require('path/to/whatever.php');
	$_SESSION['antibotcode'] = md5(strtolower($bota));
	session_write_close();

Now in your form, add this field, change teh style how you want and dump the paragragh tags if you want. If your form is not inside php tags, remove this ' . $botq . ' and replace it with <?php echo $botq; ?> . I hate design integrated with code, but to each his/her own, right?

<p style="margin-top:0px;padding-top:0;"><span style="color:red;">* Human verification: </span><strong>' . $botq . '</strong><br style="height:35px;" /><input type="text" name="b" /></p>

Ok finally, in the script that you parse the form, you want to do this:

	if (!empty($_POST['b'])) {
		$b = md5(strtolower($_POST['b']));
	} else {
		echo 'Go back and fill out all fields! Pretty please?';
	}
	if (!empty($_SESSION['antibotcode'])) {
		if ( $b != $_SESSION['antibotcode'] ) {
			unset($_SESSION['antibotcode']);
			echo 'Code typed incorrectly. Go back.';
		}
	} else {
		echo 'Hmmm, how did you get here without the proper session being set?';
	}
	unset($_SESSION['antibotcode']);
                // all is good, continue parsing form!

This is just a sample, but it gives you the general idea and you can change it to your specific needs.

* I like this, because I can include some very funny questions to give my guests a giggle as they sign up.


.

 

[Charles Sweeney]

This is an example of "security through obscurity". It's easy to break by simply visiting the site and making a list of the answers to the small number of questions and feeding them to your bot.

I have never used a CAPTCHA. Mainly because they are a pain for humans and it puts a barrier in the way of the visitor, having to complete another step or jump over another hurdle before reaching you.

If it's for a contact form there's better ways to block spam. Simply blocking "http://" will block most spam, presuming you don't expect your genuine visitors to submit "http://".

You can require a cookie as most spam bots probably won't accept one (though they easily could if they wanted). Just setting the session will set a cookie on a default setup, which you can check for when the form is submitted.

When I owned FormToEmail.com I offered these methods, amongst others.

For me, I would much rather accept spam than miss a genuine enquiry which could lead to a sale. Yes I got spam, but using MailWasher it was very easy for me to quickly delete it.

On the other hand, if your form is for signing up to something, you could get the visitor to confirm their email address before being registered.

The above methods will be good for practically all sites. If the site is HUGELY busy, then maybe there is a case for the dreaded CAPTCHA but even at that, I think I would rather employ people to check submissions. I have a car sales site. A new user can't post a listing until it's been humanly reviewed (i.e. by me). I can check hundreds of listings very quickly as spam or junk stands out a mile, and if I got hugely busy I would be happy to employ someone to do the same thing!