I can't figure out why the server's response doesn't allow me to validate the recaptcha. My PHP code is:
$captcha = $_POST['g-recaptcha-response'];
$secret = "my key";
$postdata = "secret=".$secret."&response=".$captcha;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://www.google.com/recaptcha/api/siteverify");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$server_output = curl_exec($ch);
$out = json_decode($server_output);
curl_close($ch);
if($out->success == true){/*make stuff*/} /* when the user clicks, $out->success is not true! */
My HTML form is quite ordinary.
<form method="POST" id="form">
<!-- inputs -->
<div class="g-recaptcha" data-sitekey="my key" style="margin:10px"></div>
<input type="submit" name="submit" value="Valider">
</form>
I know the problem must be really silly. I've found a workaround which is, instead of checking if $out->success==true
, checking if strlen($captcha) > 1
. But I'm pretty sure it's not very likely to block robots... Any idea? Thanks...
EDIT: I just ran a ZAP attack on my website (ZED attack proxy, a security tool from OWASP foundation). It fails completing the sign-up form (before that, it was able to create 100 users in less than a minute!). So this means that some robots will blocked. I still want to get it done properly though...
echo $out;
- what does this give you?