Implementation of Recaptcha (help?!)

**dragansk** · 09-15-2011 04:57 AM

Hello avryone.
I have a problem with my site, I need your help.
The problem is: constantly anoyne spam on my web site, constantly anyone
create ads on my webpage. My page is for create facebook like phrases.
I need your help to install Recaptcha. I followed these steps

http://code.google.com/apis/recaptcha/intro.html
But I encountered a problem
when you write something and click Send to create phrase, if you enter

wrong Recaptcha key says: "The reCAPTCHA wasn't entered correctly. Go

back and try it again" its ok, but when you insert corectrly key says: "Could

not open socket".
The code is follow:

PHP Code:


//beginning of index.php
<?
include ("config.php");
if ($_POST["fb"]) {
    $fb=$_POST["fb"];
    mysql_query("INSERT INTO fblike VALUES(NULL, '$fb', '1')");
    $x=mysql_query("SELECT * FROM fblike ORDER BY id DESC 

LIMIT 1");
    while ($y=mysql_fetch_assoc($x)){
$id=$y['id'];
}



require_once('recaptchalib.php');
  $privatekey = "private key here ";
  $resp = recaptcha_check_answer ($privatekey,
                                $_SERVER["REMOTE_ADDR"],
                                $_POST["recaptcha_challenge_field"],
                                $_POST["recaptcha_response_field"]);

  if (!$resp->is_valid) {
    // What happens when the CAPTCHA was entered incorrectly
    die ("The reCAPTCHA wasn't entered correctly. Go back and try it 

again." .
         "(reCAPTCHA said: " . $resp->error . ")");
  } else {
    // Your code here to handle a successful verification
  }
  ?>



 <script type="text/javascript"> window.location.href="<?=$url_site?

>like.php?id=<?=$id?>";</script>
    <?
}
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" 

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head></head>
..
...
....
<body>

<div class="form">
 <?php
          require_once('recaptchalib.php');
          $publickey = "Public key"; // you got this from the signup page
   ?>
                         <form method="POST" action="index.php">


 


                               <div><textarea cols="" rows="" class="input-textarea 

autoclear" name="fb" id="message">Your message</textarea></div>
                                <div><input type="submit" value="Send"  

class="button button-blue float-right" /></form>


 <?php
echo recaptcha_get_html($publickey);

 ?>

</div>

this is my page url: http://lajkovi.x10.mx/
Can anoyne help me?
thank you

**misson** · 09-15-2011 06:18 AM

What version of the reCAPTCHA lib are you using?

Connections to port 80 on most servers is blocked due to abuse. You could petition an admin to open port 80 for the reCAPTCHA server, which is www.google.com. There are two potential issues with this: a social and a technical one. The former is that it will open up the Google servers for other uses, including potential abuse. The technical issue is that the domain resolves to any one of a number of IP addresses on many different subnets. Firewall rules are generally based on IP addresses rather than domain names since they are enforced at a lower level (the link layer, while domain names are a part of the application layer). Mitigating the technical issue is that typically the domain will only resolve to a single subnet for DNS requests from client IPs in a given subnet (basically, a subnet of clients is generally assigned to a single subnet of Google servers). Also, an internal X10 DNS server could be used to further limit the addresses used by the X10 web servers themselves.

Code indentation should be consistent, for the sake of readability.

Originally Posted by d.stojchevski81

PHP Code:


<?

include ("config.php");

if ($_POST["fb"]) {

Use isset() or empty to test whether a variable or array item is defined, so that your code will work when notices are enabled.

PHP Code:


if (! empty($_POST["fb"])) {

Originally Posted by d.stojchevski81

PHP Code:


    $fb=$_POST["fb"];

    mysql_query("INSERT INTO fblike VALUES(NULL, '$fb', '1')");

The sample code is vulnerable to SQL injection, which is a very serious security risk. To fix this hole, switch from the outdated mysql extension to PDO and use prepared statements. If you need a PDO tutorial, try "Writing MySQL Scripts with PHP and PDO". The site you save may just be your own.

Originally Posted by d.stojchevski81

PHP Code:


    $x=mysql_query("SELECT * FROM fblike ORDER BY id DESC LIMIT 1");

    while ($y=mysql_fetch_assoc($x)) {

        $id=$y['id'];

    }

Don't use SELECT *; select only the columns you need.

You only need a loop if you're fetching more than one value. Drop the while and use just a fetch. To simplify things even more, use PDOStatement::fetchColumn.

To get the generated ID from the INSERT statement, use LAST_INSERT_ID(). For one thing, the current implementation will sometimes fail when the server is handling multiple page requests, when the INSERT from one request comes between the INSERT and SELECT for another request.

PHP Code:


$lastIdQuery = $db->query('SELECT LAST_INSERT_ID()');

$id = $lastIdQuery->fetchColumn();

Originally Posted by d.stojchevski81

PHP Code:


  $resp = recaptcha_check_answer ($privatekey,

You should post complete, concise sample code. For common libraries, post a link to the relevant library or (if the source is available on the web) to the source itself. For example: recaptcha_check_answer

Originally Posted by d.stojchevski81

PHP Code:


    die ("The reCAPTCHA wasn't entered correctly. Go back and try it again." .

         "(reCAPTCHA said: " . $resp->error . ")");

Don't use die when outputting HTML. You'll get invalid HTML.

Originally Posted by d.stojchevski81

PHP Code:


 <script type="text/javascript"> window.location.href="<?=$url_site?>like.php?id=<?=$id?>";</script>

**dragansk** · 09-15-2011 08:39 AM

I don`t know very good Php programing language,
can I send you index.php and like.php files and can you tidied code with any reCAPTCHA lib. thank you

**Dead-i** · 09-15-2011 09:45 AM

Just to point out that although reCaptcha is a good way of preventing spam bots, new spam bots have been created that can get past reCaptcha filters.

One of the best, up to date methods is actually a simple random question and answer system, except with harder questions that isn't like '1 + 1' or 'What colour is the sky'.

**dragansk** · 09-15-2011 03:59 PM

Originally Posted by misson

What version of the reCAPTCHA lib are you using?

Connections to port 80 on most servers is blocked due to abuse. You could petition an admin to open port 80 for the reCAPTCHA server, which is www.google.com. There are two potential issues with this: a social and a technical one. The former is that it will open up the Google servers for other uses, including potential abuse. The technical issue is that the domain resolves to any one of a number of IP addresses on many different subnets. Firewall rules are generally based on IP addresses rather than domain names since they are enforced at a lower level (the link layer, while domain names are a part of the application layer). Mitigating the technical issue is that typically the domain will only resolve to a single subnet for DNS requests from client IPs in a given subnet (basically, a subnet of clients is generally assigned to a single subnet of Google servers). Also, an internal X10 DNS server could be used to further limit the addresses used by the X10 web servers themselves.

Code indentation should be consistent, for the sake of readability.

Use isset() or empty to test whether a variable or array item is defined, so that your code will work when notices are enabled.

PHP Code:


if (! empty($_POST["fb"])) {

The sample code is vulnerable to SQL injection, which is a very serious security risk. To fix this hole, switch from the outdated mysql extension to PDO and use prepared statements. If you need a PDO tutorial, try "Writing MySQL Scripts with PHP and PDO". The site you save may just be your own.

Don't use SELECT *; select only the columns you need.

You only need a loop if you're fetching more than one value. Drop the while and use just a fetch. To simplify things even more, use PDOStatement::fetchColumn.

To get the generated ID from the INSERT statement, use LAST_INSERT_ID(). For one thing, the current implementation will sometimes fail when the server is handling multiple page requests, when the INSERT from one request comes between the INSERT and SELECT for another request.

PHP Code:


$lastIdQuery = $db->query('SELECT LAST_INSERT_ID()');
$id = $lastIdQuery->fetchColumn();

You should post complete, concise sample code. For common libraries, post a link to the relevant library or (if the source is available on the web) to the source itself. For example: recaptcha_check_answer

Don't use die when outputting HTML. You'll get invalid HTML.

<script> elements must be placed within the <head> or <body> of the document.

Moreover, you should be using an HTTP redirect rather than JS, which you can do with header(). For one thing, not everyone has JS enabled or is using a JS-enabled browser; you should always consider accessibility.

On the topic of accessibility, the textarea in the form could use a corresponding <label>.

this is all code of my script, http://www.text-upload.com/read.php?id=139144&c=3607101
can you repair this code with Recaptcha
thank you

)

**misson** · 09-15-2011 05:24 PM

Originally Posted by dragansk

I don`t know very good Php programing language,
can I send you index.php and like.php files and can you tidied code with any reCAPTCHA lib. thank you

No. If you want someone else to do your work, hire them. Otherwise be prepared to learn. Make an effort. Your site is your responsibility.

There's no need to quote any part of a post, let alone the entirety, if you're not responding directly to it. Doing so lowers the signal-to-noise ratio.

**morbid_leathal92** · 09-16-2011 09:35 PM

great ..thanks

Thread: Implementation of Recaptcha (help?!)

LinkBack

Thread Tools

Display

Implementation of Recaptcha (help?!)

Re: Implementation of Recaptcha (help?!)

Re: Implementation of Recaptcha (help?!)

Re: Implementation of Recaptcha (help?!)

Re: Implementation of Recaptcha (help?!)

Re: Implementation of Recaptcha (help?!)

Re: Implementation of Recaptcha (help?!)

Similar Threads

my recaptcha stoped working after activating the cloudflare system

Where do I find reCaptcha private/public key pair

reCAPTCHA

Security Implementation

reCaptcha form input box displays outside its <div> in IE7

Posting Permissions