2

I was just wondering if something like this would work:

  • The page displays a form, with a captcha code inside it.
  • When this form is generated, a transient is set to store the captcha code.
  • The vistor submits the form
  • After submit $_POST['captcha'] is compared to the transient from the database; if matched return success, otherwise fail
  • Delete the transient

What do you think? Is this secure?

Improve this question
2
  • Ho @Alex: What problem are you really trying to solve?
    – MikeSchinkel
    Commented Sep 1, 2010 at 2:40
  • well I described it above... I'm trying to find a very simple way to add captchas to custom forms generated by a shortcode, without having to resort to plugins. I already have this working (almost), and just need your opinions if it's good to implement the captcha this way...
    – Alex
    Commented Sep 1, 2010 at 2:49

1 Answer 1

Reset to default
1

I think that, while this method could be secure, there are many advantages to using an off-the-shelf captcha system, both in terms of the security of the captcha images/audio/media, and also in terms of performance advantages like caching. If you use a captcha widget which is JavaScript based, for example, the underlying WordPress-generated page could actually be completely cached as a static page by a number of caching plugins. If you are generating the captcha in PHP each time, this would not be possible

If you do go down this route, one thing you'll want to do as well is to add a hidden nonce to the form as well to make sure that the user agent responding to the captcha is the one who you just generated it for. WordPress's wp_nonce function can help you do this easily. Otherwise, if you do not flush your captcha transients carefully, it's possible for someone to cache that page with the captcha and have another user agent send the response.

Improve this answer
2
  • Thanks Mitcho. I ended up using no captcha at all :) Basically I created a nonce like you said and put it in a transient. Then I used javascript/ajax to pull out that transient and store it in a hidden input field, 10 seconds after the page has loaded. Then, when the form is submitted, I just match the transient with the input field $_POST and decide if the message is spam or not. of course all of this doesn't work if javascript is disabled, but who has js off? :)
    – Alex
    Commented Sep 1, 2010 at 14:07
  • Sounds good. Do let us know how it goes! :)
    – mitcho
    Commented Sep 2, 2010 at 3:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.