As I was reading through the comments from this post I thought of the exact same solution. If you check the reCAPTCHA using Ajax, simply set a session variable if the check succeeded.

Then when you go to do the server-side validation, you will know if the person is already validated; just check the same session variable.

Don’t forget to unset your session variable after performing your actions, or a bot master could pass the test once, then spam like crazy subsequently because he is still validated.

In the page that validates the captcha:

if ($resp->is_valid) {
session_start();
echo ‘success’;
$_SESSION['captcha'] = 1;
}

Then on the PHP page that processes the form:

if (!$_SESSION['captcha']) {
// someone tried to bypass the captcha. Don’t waste your resources
die;
}

No doubt that is why Chris used a separate local php script to do the checking in the first place.

Alex mentioned that he is going to handle the processing during the validation operation, so in a sense there is no form-processing script, at least not one that does the ‘real’ work.

This week I implemented a two-stage form, where we needed to verify the user’s humanity at both stages, but didn’t want to put them though two reCaptchas. I implemented this by setting a random temporary ‘password’ on the user’s customer record in the backend database once they had passed the first stage, and then incorporated that password into a hidden field in the second-stage form. Seeing that password come back with the submission of the second-stage form proved the user’s humanity without requiring any extra action on their part.

I see that you use ajax.recaptcha.php to validate if a captcha is correct and then if it is, it is submited

But when someone hacks the page, he can force it to just post it anyway.

So I would like a more secure solution, that the check is done on the server and when the check is successful the filled in form is send to the database or whatever has to happen

So everything including the filled in form and captcha is send to the server.

So far as I can see this is not 100% waterproof

Could you please update me on this, since I’m looking for a solid solution to integrate a captcha in a jquery modal dialog.

gr

Jan

will you be posting the article that works with a current version of reCaptcha and incorporates all the comments and stuff? thanks

When I wrote this, reCaptcha didn’t have their own exposed AJAX API methods so I had to use alternate methods. I have finally cleared enough off my table at work to redo this article with a current version of reCaptcha.

how do i get it to actually submit the form ?

If anyone wants the full code just let me know and I can post it or email it.

Cheers.