0

Hi I have a question for google recaptcha for php

I noticed the standard line for verifying recaptcha is:

$response =file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=". $yoursecret."&response=".$_POST['g-recaptcha-response']."&remoteip=".$_SERVER['REMOTE_ADDR']);

My question is should we verify/filter/sanitize for $_POST['g-recaptcha-response'] and $_SERVER['REMOTE_ADDR']?

I thought we needed to filter/verify for everything but I couldn't find any documentation on that from google. I'm concerned someone will add something else in POST and redirect the response to another site, and then do something malicious without verification/sanitizing the $_POST variables

1
  • AFAIK I don't see a reason to validate this user input in this scenario. Don't quote me in this tho.
    – Joas
    Apr 17, 2018 at 20:15

1 Answer 1

1

You should wrap urlencode around anything before inserting it into a query string, if only for reliability. Alternatively, stop building up URLs by munging strings together, and leave it to the built-in function http_build_query:

$url = 'https://www.google.com/recaptcha/api/siteverify?' . http_build_query([
    'secret' => $yoursecret,
    'response' => $_POST['g-recaptcha-response'],
    'remoteip' => $_SERVER['REMOTE_ADDR'],
]);

$response = file_get_contents($url);

Whether there's an obvious security vulnerability or not, always run things through any relevant encoding. If $_POST['g-recaptcha-response'] contains a character that requires encoding differently in future (e.g. &), then you'll avoid problems before they happen.

3
  • To tack on to this, you don't really need to sanitize the input since you aren't doing anything with it, you are just passing it on to Google, who's certainly going to sanitize it if necessary anyway. Apr 17, 2018 at 21:52
  • okay cool thank you. So there is no way to tack on something in $_post and make https://www.google.com/recaptcha/api/siteverify?secret= a subdomain of another site right, and then have the response return positive etc. like the / or the = prevents that right. I worry an attacker could do like https://www.google.com.malwaresite.com and then load something bad
    – john doe
    Apr 17, 2018 at 22:05
  • actually i read up on allowed characters for subdomains and apparently the / ends that attack so thank you for all your help. i have adhd a lot
    – john doe
    Apr 17, 2018 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.