PHP Captcha Creation Script

This script is called captcha-with-sessions.php

It's nice to know that the HTML gurus don't mind an image tag with a PHP script instead of an image file whose extension is png, jpg, or gif. It's sure convenient!

The next script was fun to write but we must confess that the "sessions at the end of the script" necessity threw us for quite a while! Who knew? The header('Content-Type: image/png') declaration limits what you can do in your PHP scripting as long as the created image is among the living. So, nuts to sessions and the echo() function while the image's heart is still beating. Once you drive a stake through it, you can program normally. Echo() is about outputting text to the browser screen. PHP doesn't like to see that you are outputting text if you told it you're outputting an image. But once the image is kaput, you may output normally. There may be a few restrictions because of that header, but sessions (after image destruction) is not one of them.

In the script, we are trying for a random captcha. So we use the PHP function mt_rand(). The mt_rand() function returns a random integer using the Mersenne Twister algorithm. The two numbers one usually puts into the parameters are the lowest and highest integers, inclusively, that you want the function to return. Our first two uses of the function give us the digits we will be adding or subtracting, while the third use is to get a number to help us decide whether we will add or subtract. So we stick "minus" or "plus" into $a, depending on whether the number is greater than 4, since we limited it to 0 through 9. So, depending on whether $a is "minus" or "plus", we add or subtract the numbers and put the result in $s. Then we build the captcha question and put this result in $w.

In informing PHP about our font choice, $font = 'Holisb__.ttf' is used. This assumes you loaded the font into the folder your script is in. We use the PHP GD Library function imagecreatetruecolor() after defining its size. Then we use the function imagecolorallocate() to define some RGB colors. We fill the image with gray using imagefill(). Then we use imageline() to draw a border. Next we use imagettftext() to draw the captcha text into the image using TrueType fonts. We output the image with imagepng(), then kill it in memory—but not its output in the browser—with imagedestroy().

We start up sessions, stick our correct captcha answer in our session variable $_SESSION['a__________a'], and that's it. The image is on the screen and out of memory and the correct answer is now available to scripts via that session variable, which we will be comparing with the user's input.

We use this captcha script with these scripts:

Register Group with Captcha
Edit Group Profile
Login to MC Search and Match Profile and Account Management
MC Questionnaire
MC Questionnaire Login

Each of the above use our captcha. We used the official captcha method in our Personal Status Board (PSB™) scripts, but designed a less cumbersome method for our MC registration scripts.

Take a gander at the way we use our captcha creator file: <IMG SRC="captcha-with-sessions.php" alt='captcha'> in the above scripts. A pretty strange type of image, to be sure! Browsers do NOT mind PHP scripts sitting in for PNG, BMP, GIF, or JPG images, believe it or not. The message "If you see no Captcha, disable your ad blocker" is displayed near the captcha because ad blockers with strong settings may knock the captcha out of the form. But Pop-up Blockers do not molest our captcha since it is NOT a pop-up. It's a random PNG image created using functions from the GD library, which is in all recent PHP versions. (To use the recommended bundled version of the GD library, which was first bundled in PHP 4.3.0, get your server hosts to use the configure option "--with-gd". Most already do this.)

The captcha image uses the font Holisb__.ttf, which is the Holiday Springs BTN True Type Font (get at MyFonts.com), but you may use other types if you wish. If you find arial.ttf in your C:\WINDOWS\Fonts\ directory on your computer, make sure it is in your folder with your PHP scripts on your server. Holisb__.ttf does a much cooler job, and will be harder for any automatic spambot script to read (and get the right answer for the arithmetic problem).

The script below is called: captcha-with-sessions.php

<?php

header('Content-Type: image/png');

$r=mt_rand(10,90);$i=mt_rand(1,9);$d=mt_rand(0,9);
if($d>4){$a="minus";}else{$a="plus";}
if($a=="minus"){$s=$r-$i;}else{$s=$r+$i;}
$w="What is ".$r." ".$a." ".$i." ? ";
$font = 'Holisb__.ttf';
//Holiday Springs BTN True Type Font (get at MyFonts.com)
$wide = 210;
$high = 41;
$picture = imagecreatetruecolor($wide,$high);
$gray = imagecolorallocate($picture,223,223,223);
$red = imagecolorallocate($picture,255,128,128);
imagefill($picture,0,0,$gray);
$black=imagecolorallocate($picture, 0, 0, 0);
imageline($picture, 0, 0, 0, $high, $black);
imageline($picture, 0, 0, $wide, 0, $black);
imageline($picture, $wide-1, 0, $wide-1, $high-1, $black);
imageline($picture, 0, $high-1, $wide-1, $high-1, $black);
imagettftext($picture, 20, 0, 11, 27, $red, $font, $w);
imagettftext($picture, 20, 0, 10, 26, $black, $font, $w);
imagepng($picture);
imagedestroy($picture);

include_once"checkid.php";
$_SESSION['a__________a'] = $s;

?>

Free Personal Status Boards (PSB™)

PHP Captcha Creation Script