Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I was just wondering if something like this would work:

  • The page displays a form, with a captcha code inside it.
  • When this form is generated, a transient is set to store the captcha code.
  • The vistor submits the form
  • After submit $_POST['captcha'] is compared to the transient from the database; if matched return success, otherwise fail
  • Delete the transient

What do you think? Is this secure?

share|improve this question
    
Ho @Alex: What problem are you really trying to solve? –  MikeSchinkel Sep 1 '10 at 2:40
    
well I described it above... I'm trying to find a very simple way to add captchas to custom forms generated by a shortcode, without having to resort to plugins. I already have this working (almost), and just need your opinions if it's good to implement the captcha this way... –  Alex Sep 1 '10 at 2:49
add comment

1 Answer 1

up vote 1 down vote accepted

I think that, while this method could be secure, there are many advantages to using an off-the-shelf captcha system, both in terms of the security of the captcha images/audio/media, and also in terms of performance advantages like caching. If you use a captcha widget which is JavaScript based, for example, the underlying WordPress-generated page could actually be completely cached as a static page by a number of caching plugins. If you are generating the captcha in PHP each time, this would not be possible

If you do go down this route, one thing you'll want to do as well is to add a hidden nonce to the form as well to make sure that the user agent responding to the captcha is the one who you just generated it for. WordPress's wp_nonce function can help you do this easily. Otherwise, if you do not flush your captcha transients carefully, it's possible for someone to cache that page with the captcha and have another user agent send the response.

share|improve this answer
    
Thanks Mitcho. I ended up using no captcha at all :) Basically I created a nonce like you said and put it in a transient. Then I used javascript/ajax to pull out that transient and store it in a hidden input field, 10 seconds after the page has loaded. Then, when the form is submitted, I just match the transient with the input field $_POST and decide if the message is spam or not. of course all of this doesn't work if javascript is disabled, but who has js off? :) –  Alex Sep 1 '10 at 14:07
    
Sounds good. Do let us know how it goes! :) –  mitcho Sep 2 '10 at 3:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.