将用户输入的 CAPTCHA 值与会话中存储的预期值进行比较

发布于 2024-10-31 19:34:25 字数 437 浏览 0 评论 0原文

我正在尝试在我正在构建的表单中实现一个简单的验证码，但我遇到了一个我自己似乎无法解决的问题。

我使用简单的代码来生成一个随机数，如下所示

$randomnr = rand(1000, 9999);
$_SESSION['randomnr2'] = md5($randomnr);

......然后使用更多代码来生成随机数的图像并将其显示在页面上。我反对这样的有效性......

if (strlen($captcha) !== ($_SESSION['randomnr2'])) { 
    $error['captcha'] = "CAPTCHA error. Please try again";
}

我如何根据会话randomnr2中存储的随机数检查输入验证码输入字段的值？

原文

I'm trying to implement a simple captcha into a form I'm building but I've run up against an issue I can't seem to sort out by myself.

I'm using simple code to generate a random number like so ....

$randomnr = rand(1000, 9999);
$_SESSION['randomnr2'] = md5($randomnr);

.... and then some more code to generate an image of the random number and display it on the page. I'm against it for validity like this ....

if (strlen($captcha) !== ($_SESSION['randomnr2'])) { 
    $error['captcha'] = "CAPTCHA error. Please try again";
}

How do I go about checking the value that's been input into the captcha input field against the random number that's stored in the session randomnr2?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

给我一枪 2024-11-07 19:34:25

我不确定为什么您要根据此处字符串的 md5 哈希值检查字符串的长度，但假设 $captcha 是来自用户的数字，您可以这样做：

if(md5($captcha) !== $_SESSION['randomnr2']) {
  $error['captcha'] = "CAPTCHA error. Please try again";
}

I'm not sure why you are checking the length of the string against an md5 hash of the string here, but assuming $captcha is the number from the user, you can just do this:

if(md5($captcha) !== $_SESSION['randomnr2']) {
  $error['captcha'] = "CAPTCHA error. Please try again";
}

回复收藏 0 原文

昔日梦未散 2024-11-07 19:34:25

对于 strlen()，PHP 会自动将任何内容转换为字符串（如果可以），因此

echo strlen(42); 
echo strlen('42');

两者都会输出“2”，即使第一个是整数。要将提交的值与存储的值进行比较，就像

if ($_SESSION['randomnr2'] === (int)$captcha) {
   ... it matched ...
}

您需要再次将提交的值转换为 int 一样简单，因为 PHP $_GET/POST 数组中的任何内容在内部都被视为字符串。

PHP will auto-convert anything to a string (if it can) for strlen(), so

echo strlen(42); 
echo strlen('42');

will both output '2', even though the first one's an integer. To compare the submitted value to the store value, it's as simple as

if ($_SESSION['randomnr2'] === (int)$captcha) {
   ... it matched ...
}

You'll want to cast the submitted value to an int again, as anything in the PHP $_GET/POST arrays is internally treated as a string.

回复收藏 0 原文

风月客 2024-11-07 19:34:25

<div id='captcha_to_show' style='border:1px solid silver;'>gobldeygook</div>
<input name='captcha' id='captcha'>

...

通过 scriptmonkey 附加...

$('document').ready(function(){
  $('#captcha').val($('#captcha_to_show').html());
});

查看开源验证码脚本。您的实现将要求在页面上发送验证码，无论拉动页面的内容都可以看到其值，并且该人/机器人/任何内容都可以相应地填写验证字段，因此您实际上拥有零保护。这就是为什么验证码要么使用难以用脚本阅读的复杂图像，要么使用人类在上下文中比机器人更容易理解的语义问题，例如“你认为 1 和 3 的总和是多少？” === 4]。是的，带有设置字体、间距和大小的更简单的图像验证码可以通过某种像素模式字典攻击来破解。

<div id='captcha_to_show' style='border:1px solid silver;'>gobldeygook</div>
<input name='captcha' id='captcha'>

...

attached via scriptmonkey...

$('document').ready(function(){
  $('#captcha').val($('#captcha_to_show').html());
});

look into a open-source captcha script. your implementation is going to require sending that captcha across the page in a way that it's value can be seen by whatever is pulling the page, and that person/bot/whatever can fill in the validating field accordingly, so you actually have zero protection. that is why captchas either use convoluted images that are hard to impossible to read with a script, or semantic questions better understood by humans in context than bots, such as ['What would you say the sum of one and 3 are?' === 4]. and yes, the more simple image captcha's with the set fonts, spacing and size can be hacked with a sort of pixel-pattern dictionary attack.

回复收藏 0 原文

~没有更多了~