Your IP Address is 38.103.63.61
Google
 
Web This Website
   

 

A php script freely available to give back to the open source community

ADDITIONAL NOTES:  Since this script was made available awhile back, several other projects with similar purpose have become available and one derived from this.  The naming that has become most frequently used for this purpose is CAPTCHA, completely automated public Turing test to tell computers and humans apart

These scripts can be defeated by using OCR.  If you are a company protecting finances or privacy, spend the resources to do something better and hire some writers and make it open source to make it safer with community oversight.  We include the following information and a working Open Source example of applications that adequately work, provide a good starting place for concept, but could be defeated with someone investing labor and resources to setup an attack with OCR recognition.

See Also the Wikipeida definition of Captcha that give more information
http://en.wikipedia.org/wiki/Captcha

  • p.s.  You may also want to set a date/time check on your mail delivery if cc goes to a pager, to disable messaging during the 6 hours you get to sleep as an sysadmin..

  • A derivation with improvements has been brought to our attention:
    http://www.activistinabox.org/blockautosubmit/

Blocking Automated Submissions using image features of php

A folder with php code to require viewer to identify characters in an image before form submission is allowed. Features index.php storing the random characters in session for generateimage.php to use, some settings in config.php, with a unique twist it searches a subfolder 'ttf' for true type fonts to use while composing the characters on the image so you can add or remove fonts on the fly.  Do be careful about copyright on true type fonts! 

Requirements: 

  • PHP supporting version GD 1.6.3 or better (may or may not work lower than that, tested with gd-1.8.3).  Effort was made to avoid php functions requiring GD 2.x or later however that may impact using more colors and possibly type 2 true type fonts.  Let us know your experiences.
  • True Type Font rendering for GD program, tested with freetype-1.3.1
  • And probably several other applications that were not obvious to you, let us know what was not obvious and we will list here :)

Demonstration:  http://www.cocoavillagepublishing.com/development/tools/php/scripts/blockautosubmit/ 

License was intended to be BSD style so that it can be used and modified by others for commercial and non-commercial use:
http://www.cocoavillagepublishing.com/development/tools/php/scripts/blockautosubmit/license.txt 

Archived source using ZIP:

http://www.cocoavillagepublishing.com/development/tools/php/scripts/download/blockautosubmit_v0.2.zip 

older:   blockautosubmit_v0.1.zip 

Archived source using TAR compressed with GZIP: http://www.cocoavillagepublishing.com/development/tools/php/scripts/download/blockautosubmit_v0.2.tar.gz 

older:  blockautosubmit_v0.1.tar.gz 

FAQ

Q.  The image appears but the characters are not showing up, suggestions?

A.  If for some reason the session is not registering the random character string created on the form page then when the web server tries to open the graphic "generateimage.php" that php script won't be able to get the string from the session so you may want to verify that the scripts are able to use the session properly to store the important random string for the image.
  Test that your setup with php can create images with text using the functions like is_dir and imagegettftext that are used in by file generateimage.php   You may need to edit php.ini and elsewhere to allow script to read the subdirectory ttf or modify/simplify the code so it does not have to get a directory listing to determine what ttf fonts it can choose. Also note that we set the output of generateimage.php to be jpeg but you may could use png. Note that the imagegettftext function allows us to rotate the text!

Q.  How about ASCII art instead of an image?

A.  Added that option with version 0.2 and play with settings in the config.php file

Q. Can I make it harder to OCR by changing the background?

A.  Look at generateimage.php and you will see a conditional that if $BASaddimgnoise = "yes" then the script will create random arcs over the background in the font color and an off color.  To engage, edit config.php and change the variable $BASaddimgnoise to be "yes". We think that something better could be done and welcome contributions, but if possible we request that the noise method work with versions of GD prior to 2.x so that limits some of the php image commands that may be more convenient for drawing.  For example, the function imagefilledellipse was added in PHP 4.0.6 and requires GD 2.0.1 or later

Q.  The characters are to hard to read, and I sometimes can't tell difference between number one and some letters, what can I do?

A.  You could modify the script to use numbers only on the random generation. Also you could reduce the ttf fonts to choose from, and or replace with ttf files that have easier to read fonts.  Many sites using image verification are only using numbers that don't randomly rotate the characters but instead have an image with static dots, lines and curves.  In our example we went to the extreme selecting what we thought to be hard to OCR fonts that the license was interpreted as freely distributable for commercial use.

Q.  Why did you use the verbose <script language="php"> tags instead of <?

A.  We recommend you don't be lazy on the tags if the files may be edited in by other applications.  Programs like Dreamweaver and Frontpage know how to handle <script language="xyz">blah </script>,  however they can not display in a design or preview view with the abbreviated tagging of PHP.

Q.  Why gd?

A. GD is available on most php installations.  We think other applications like NetPBM and ImageMagick which are used by Gallery which is php may give more resources and writers may want to consider that.

Q.  Why did you write such sloppy code, why not all functions and classes?

A. It was a hack with spare time not elegance, but with lots of comments. Step forward and rewrite it and donate it back or under the BSD license take the code and redo or rather fork the works. Let us know and we will link.

Q.  Why not use another figlet class that is more recently supported like the class in PEAR? 

A.  The included php figlet class is about two years old and the author does not support it on the mentioned website, but it seems to be working.  Some php sites are not setup with PEAR, so we used this simpler file.  Note the license for the php filget class not by us and if in the future someone complains we will have to reference it or remove it.  Perhaps in the future we will go with PEAR or other figlet if need be. See http://www.figlet.org/ for more information about figlet.

Q.  How about an audio captcha?

Here is an article of someone using an audio captcha:  http://www.ejeliot.com/pages/2

 

       

Disclaimer: This media is distributed with the understanding that the information presented is from various sources, from which there can be no warranty or responsibility by Cocoa Village Publishing, Inc. as to the legality, completeness and accuracy, except when otherwise stated in writing. Rights to information herein remain the property of their respective owners and may not be reproduced without appropriate authorization. Copyright © 2005 Cocoa Village Publishing, P.O.Box 218, Cocoa FL 32923 USA
Phone (321) 633-4990 • Fax (321) 633-4997 • www.cocoavillagepublishing.com • questions@cocoavillagepublishing.com
services   marketing   e-commerce   development   connectivity   us

You may also be interested the RSS web feed websites about the SpaceCoast, www.SpaceCoast.info and More of Orlando,