1

I can't figure out why the server's response doesn't allow me to validate the recaptcha. My PHP code is:

$captcha = $_POST['g-recaptcha-response'];
$secret = "my key";   
$postdata = "secret=".$secret."&response=".$captcha;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://www.google.com/recaptcha/api/siteverify");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$server_output = curl_exec($ch);
$out = json_decode($server_output);
curl_close($ch);
if($out->success == true){/*make stuff*/} /* when the user clicks, $out->success is not true! */

My HTML form is quite ordinary.

<form method="POST" id="form">
<!-- inputs -->
    <div class="g-recaptcha" data-sitekey="my key" style="margin:10px"></div>
    <input type="submit" name="submit" value="Valider">
</form>

I know the problem must be really silly. I've found a workaround which is, instead of checking if $out->success==true, checking if strlen($captcha) > 1. But I'm pretty sure it's not very likely to block robots... Any idea? Thanks...

EDIT: I just ran a ZAP attack on my website (ZED attack proxy, a security tool from OWASP foundation). It fails completing the sign-up form (before that, it was able to create 100 users in less than a minute!). So this means that some robots will blocked. I still want to get it done properly though...

3
  • Can you try to echo the output: echo $out; - what does this give you? Mar 1, 2017 at 10:17
  • Hello, yes I've tried to echo it, with strval, but it's empty...
    – Zoette
    Mar 1, 2017 at 22:41
  • how about echoing the output before decoding it? Mar 3, 2017 at 11:34

1 Answer 1

0

Can you try to send your data as an array like that :

$postdata = array(
    'secret' => $secret,
    'response' => $captcha
);
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.