Captcha question

I've attached Captcha to a contact form on a website and we are still getting several submissions that are in Chinese or are seemingly autofill junk. I've attached the files, I'm just curious to know if I've used it and added it correctly.

thanks,

No, it is not implemented correctly. You are simply validating that any value was entered into the form field. You should be using "Like Entry" validation and not just "Required" validation.

Then you can compare the entered value with the session variable: $_SESSION["captcha_Security_Code_1"] and make sure they are the same and not just that a value was entered like you are now.

Hi Ray, I've updated the areas that you've instructed and it seems that it's still submitting even if I input just one letter in the captcha???? Thanks so much for your help!

You are comparing the $_POST value to the $_POST value... you need to compare the $_POST value to the $_SESSION value like I pointed out above.

The $_POST value will always be equal to itself, so yes it will submit no matter what is entered.

I am still having issues with this. I guess maybe I'm not understanding where I'm going wrong?? Any assistance is greatly appreciated.

I don't even see CAPTCHA in that form or server validation on that page? What page should I be looking at?

So sorry. Here are the correct files.

Line 11 should be:

$WAFV_Errors .= WAValidateLE(strtolower(((isset($_SESSION["captcha_Security_Code_1"]))?$_SESSION["captcha_Security_Code_1"]:"")) . "",strtolower(((isset($_POST["Security_Code_1"]))?$_POST["Security_Code_1"]:"")) . "",true,1);

Thanks for your help! I replaced the code as suggested. Where did I go wrong? In the server validation, I'm assuming I picked the incorrect values? Moving forward I would like to have a better understanding. Thanks again!

Yes, when you applied the server validation you compared the submitted form value to itself... which will always match.

You need to compare the value entered into the form element to the Session value stored by the CAPTCHA, which is what the updated code does.