苦苦挣扎与recaptcha v2和表单提交

时间:2014-12-03 05:41:49

标签: php json forms recaptcha

https://developers.google.com/recaptcha/docs/verify

if(isset($_POST['submit'])){
$recaptchaResponse = $_POST['g-recaptcha-response'];
$secretKey = 'MYKEY';
$request = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=".$secretKey."&response=".$recaptchaResponse);

    if(!strstr($request,"false")){
echo '<div class="notification error clearfix"><p><strong>Attention!</strong> You didnt complete the captcha.</p></div>';
exit();

然后php文件的其余部分邮寄表单,但即使你没有完成recaptcha,它仍然只是发送。基本上,如果JSON返回false,我希望它不会发送并显示错误

如果它有帮助,这里也是页面的形式,我也可能在那里做错了...

<form method="POST" action="post.php" name="contactform" id="contactform" class="container">

            <fieldset>
                <div class="form-field grid-half">
                    <label for="name">Name</label>
                    <span><input type="text" name="name" id="name" /></span>
                </div>
                <div class="form-field grid-half">
                    <label for="email">Email</label>
                    <span><input type="email" name="email" id="email" /></span>
                </div>
                <div class="form-field grid-full">
                    <label for="message">Message</label>
                    <span><textarea name="message" id="message"></textarea></span>
                </div>                  
                <div class="form-field grid-full">
                        <div class="g-recaptcha" data-sitekey="MYKEY"></div>
                </div>
            </fieldset>
            <div class="form-click grid-full">
                <span><input type="submit" name="submit" value="Submit" id="submit" /></span>
            </div>

            <div id="alert" class="grid-full"></div>
        </form>     

7 个答案:

答案 0 :(得分:24)

我发现有时,根据PHP版本/配置,直接访问对象将无效,因此请使用json_decode()

/* $response object returned from https://www.google.com/recaptcha/api/siteverify via which ever method you use */

$obj = json_decode($response);
if($obj->success == true)
{
    //passes test
}
else
{
    //error handling
}

答案 1 :(得分:19)

使用curl代替file_get_contents(您和我一样,希望在服务器设置中禁用file_get_contents

$post_data = "secret=__your_secret_key__&response=".
   $_POST['g-recaptcha-response']."&remoteip=".$_SERVER['REMOTE_ADDR'] ;

$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, "https://www.google.com/recaptcha/api/siteverify");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, 
   array('Content-Type: application/x-www-form-urlencoded; charset=utf-8', 
   'Content-Length: ' . strlen($post_data)));
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data); 
$googresp = curl_exec($ch);       
$decgoogresp = json_decode($googresp);
curl_close($ch);

if ($decgoogresp->success == true)
    {
    // Success
    }

答案 2 :(得分:6)

将此代码段粘贴到HTML模板上的结束标记之前:

<script src='https://www.google.com/recaptcha/api.js'></script>

将此代码段粘贴到您希望显示reCAPTCHA小部件的位置的末尾:

<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>

示例:

<html>
  <head>
    <title>Google recapcha demo - Codeforgeek</title>
    <script src='https://www.google.com/recaptcha/api.js'></script>
  </head>
  <body>
    <h1>Google reCAPTHA Demo</h1>
    <form id="comment_form" action="form.php" method="post">
      <input type="email" placeholder="Type your email" size="40"><br><br>
      <textarea name="comment" rows="8" cols="39"></textarea><br><br>
      <input type="submit" name="submit" value="Post comment"><br><br>
       <div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>
    </form>
  </body>
</html>

<强> form.php的

<?php

        $email;$comment;$captcha;
        if(isset($_POST['email'])){
          $email=$_POST['email'];
        }if(isset($_POST['comment'])){
          $email=$_POST['comment'];
        }if(isset($_POST['g-recaptcha-response'])){
          $captcha=$_POST['g-recaptcha-response'];
        }
        if(!$captcha){
          echo '<h2>Please check the the captcha form.</h2>';
          exit;
        }
        $response=file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=YOUR_SECRET_KEY&response=".$captcha."&remoteip=".$_SERVER['REMOTE_ADDR']);
        if($response.success==true)            
        {
          echo '<h2>Thanks for posting comment.</h2>';
        }
?>

Sorce:

答案 3 :(得分:5)

首先,这里给出的答案绝对足够。 话虽这么说,我只想包含这个功能,将这些答案包装成一个稍微方便的方法,这样你就可以把它们扔进你的函数库,并且几乎忘了它直到谷歌改变了一些东西。享受!

//Put these two functions into your function library-------
function CaptchaVerify($apiSecret)
{
    //Returns -1 if no captcha response was in post(user did not submit form)
    //Returns 0 if the verification fails
    //Returns 1 if the verification succeeds
    $captcha = isset($_POST['g-recaptcha-response'])? "&response=".$_POST['g-recaptcha-response']:'';
    if($captcha != '')
    {
        $verifyUrl = "https://www.google.com/recaptcha/api/siteverify";
        $apiSecret = "?secret=".$apiSecret;
        $remoteip = "&remoteip=".$_SERVER['REMOTE_ADDR'];
        $response=file_get_contents($verifyUrl.$apiSecret.$captcha.$remoteip);
        $obj = json_decode($response);
        return (integer)$obj->success;          
    }
    return -1;
}
function MyCaptchaVerify()
{
    $apiSecret = "PUT YOUR CAPTCHA SECRET HERE";
    return CaptchaVerify($apiSecret);
}
//-------------------------------------------------------
//Example usage in your form
switch(MyCaptchaVerify())
{
    case -1:echo "The form has not been submitted yet(First Load).<br>";break;
    case  0:echo "The captcha verification failed.<br>";    break;
    case  1:echo "The captcha verification succeeded.<br>"; break;
}

答案 4 :(得分:1)

我更喜欢cURL示例到file_get_contents,因为它为错误记录等提供了更多选项。有些人发现cURL相当令人生畏。对于那些用户来说,Guzzle是一个非常好的选择。

答案 5 :(得分:0)

如果要使用Curl PHP来获取响应,则可以使用以下代码:

  if(isset($_POST['submit'])){
     $privatekey = "paste_your_privatekey";
     $responseKey = $_POST["g-recaptcha-response"];
     $userIP = $_SERVER["REMOTE_ADDR"];

     /////Curl Start///////
     $ch = curl_init();

     curl_setopt($ch, CURLOPT_URL,"https://www.google.com/recaptcha/api/siteverify");
     curl_setopt($ch, CURLOPT_POST, 1);
     curl_setopt($ch, CURLOPT_POSTFIELDS, "secret=$privatekey&response=$responseKey&remoteip=$userIP");

     // Receive server response ...
     curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

     $server_output = curl_exec($ch);
     $response = json_decode($server_output);

     curl_close ($ch);
     /////Curl Close///////

     // Further processing ...
     if ($response->success == "true") {
        Success……..
     }esle{
        Failed…………….
     }
  }

答案 6 :(得分:-5)

if (response == true) {
    mail();
} else {
    echo "error";
}