Member Avatar for andyhunter

I got the js to load but i can not figuer out how to verify without mail being passed through instead of caught out using googles example and watching you tube videos.

I am updating exisiting mail form that has validation on it.

I tried the php plugins but they wont even load, i understand the public and private key.

Really am puzzled by this if anyone would care to explain.

Edited by andyhunter
  • 3 Contributors
  • 3 Replies
  • 115 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by GliderPilot

Dani AI

Generated

Short answer: the client-side JS only produces a token. The server must verify that token in the form handler and only then call your mail routine. From your posts it looks like the JS widget loads but the PHP verification was placed "above submit" in the page — that does not stop the mail from being sent because the check needs to run when the form posts. is pointing in the right direction: do the verification in send.php (or whatever script the form posts to) and only proceed to send the email if Google says the token is valid.

Minimal workflow to follow:

  • Put the reCAPTCHA widget inside the <form> so the token gets posted with the form.
  • On submit, the handler must read the token (g-recaptcha-response for reCAPTCHA v2) and call Google's verification API with your secret key.
  • Check the API JSON reply; if success is true then sanitize inputs and send mail. If false, return an error and do not call mail().
  • Keep the secret on the server only. Do not rely on client-side checks alone.

Example server-side verification (PHP) — this is different from the old recaptcha PHP helper and works with the current verify endpoint:

$secret = 'YOUR_SECRET_KEY';
$token  = $_POST['g-recaptcha-response'] ?? '';
$remote = $_SERVER['REMOTE_ADDR'] ?? '';

if (empty($token)) { die('Please complete the CAPTCHA.'); }

$params = http_build_query(['secret'=>$secret,'response'=>$token,'remoteip'=>$remote]);
$verify = file_get_contents('https://www.google.com/recaptcha/api/siteverify?'.$params);
$result = json_decode($verify, true);

if (!empty($result['success'])) {
    // verified — sanitize inputs and send mail
} else {
    // verification failed — do not send mail
}

Troubleshooting & tips: if file_get_contents fails, use cURL and log the raw reply to debug. Make sure the site key (public) is on the page and the secret (private) is used only server-side. If using AJAX, include the g-recaptcha-response token in the posted data. For safer email sending and to avoid header-injection risks, prefer a library like PHPMailer. For up-to-date details see Google's docs on server verification and widget display: reCAPTCHA server-side verify, reCAPTCHA display, and PHPMailer.

Recommended Answers

All 3 Replies

Member Avatar for Member #949455

Really am puzzled by this if anyone would care to explain.

It would be helpful if you can post the code. I think you are using google one.

Member Avatar for andyhunter

sorry i did have googles one but it would not work. I was using the php plugin but the javascript one loads i just can work out how to validate it before sending ?

actual sending of input

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />

<meta name="viewport" content="initial-scale=1, maximum-scale=1" />

<meta name="viewport" content="width=device-width" />

<title>Emailing sending to myself</title>



</head>



</head>



<body>



<?php

    // Your code here to handle a successful verification 

    $email_to = "somewhere@email.com";

    $name = $_POST["name"];

    $email = $_POST["email"];

    $url = $_POST["url"];

    $message = $_POST["message"];

    $text = "NAME: $name<br>

             EMAIL: $email<br>

             URL: $url<br>        

             MESSAGE: $message";

    $headers = "MIME-Version: 1.0" . "\r\n"; 

    $headers .= "Content-type:text/html; charset=utf-8" . "\r\n"; 

    $headers .= "From: <$email>" . "\r\n";

    mail($email_to, "Message", $text, $headers);

?>

</body>

</html>

the code for input

<form action="send.php" id="contact-form" class="form" method="post">
            <ul> 
                <li>
                    <p><strong>Name</strong> <em>(*)</em></p>
                    <input name="name" type="text" class="requiredField" />
                </li>

                <li>
                    <p><strong>E-mail</strong> <em>(*)</em></p>
                    <input name="email" type="text" class="requiredField email" />       
                </li>

                <li>
                    <p><strong>URL</strong> <em>(Optional)</em></p>   
                    <input name="url" type="text" />
                </li>

                <li>
                    <p><strong>Message</strong> <em>(*)</em></p>
                    <textarea name="message" rows="20" cols="30" class="requiredField"></textarea>        
                </li>                
                <li class="submit-button">
                    <input class="submit" type="reset" name="reset" value="Reset"/>
                    <input name="submit" id="submitted" value="Send Message" class="submit" type="submit" />
                </li>
            </ul>

        </form><!--END CONTACT FORM-->

i placed both javascript and php plugin above submit.

Member Avatar for GliderPilot

You can load the recaptcha with JS and than handle the answer with the PHP plugin. Just upload the php library to your site and add the following code to line 31 above:

  require_once('recaptchalib.php');
  $privatekey = "your_private_key"; //Chnage this to your private key
  $resp = recaptcha_check_answer ($privatekey,
                                $_SERVER["REMOTE_ADDR"],
                                $_POST["recaptcha_challenge_field"],
                                $_POST["recaptcha_response_field"]);

  if (!$resp->is_valid) {
    // What happens when the CAPTCHA was entered incorrectly
    die ("The reCAPTCHA wasn't entered correctly. Go back and try it again." .
         "(reCAPTCHA said: " . $resp->error . ")");
  } else {
    // Your code here to handle a successful verification
    //Continue to Verify and then send your email
  }
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.