Plug in PHP 100 POWER SOLUTIONS- P32 pdf

C h a p t e r 6 : F o r m s a n d U s e r I n p u t
121
C h a p t e r 6 : F o r m s a n d U s e r I n p u t
121
You also need to embed the image URL in a hidden form field so that it can be passed
to the following function where it will be erased from the hard disk when no longer
needed. At the same time, you should embed the value of the token in another hidden
field, like this:
<input type="hidden" name="token" value="$result[1]" />
<input type="hidden" name="image" value="$result[2]" />
Taking all this into account, the following example code creates a Captcha, and then
displays the Captcha image along with a form for requesting the Captcha word to be
entered:
<?php
$result = PIPHP_CreateCaptcha(26, 8, 'captcha.ttf', '',
'!*a&K', '.fs£!+');
echo <<<_END
<img src="$result[2]" /><br />
Please enter the word shown<br />
<form method="post" action="checkcaptcha.php">
<input type="hidden" name="token" value="$result[1]" />
<input type="text" name="captcha" />
<input type="submit" />
</form>
_END;
You may wish to save this example (giving it a filename such as testcaptcha.php) as you’ll
be able to test it with an example from the following plug-in. Or you can download the file
using the Download link at pluginphp.com—look in the folder named 6 in the plug-ins.zip file.
If you would like to have random length words in your Captchas, you can achieve this
by modifying the function call to use the rand() function as in the following, which will
generate a Captcha of between four and ten letters in length:

$result = PIPHP_CreateCaptcha(26, rand(4,10), 'captcha.ttf', '',
'!*a&K', '.fs£!+');
Note that this plug-in relies on the plug-ins PIPHP_GifText(), PIPHP_GD_FN1(), and
PIPHP_ImageAlter(), so they should also appear in the same program file as this one, or
be otherwise included in it.
TIP If you ever find your Captchas are not preventing all bots anymore, perhaps because their image
recognition has improved, I suggest you upload a different TrueType font and start using that.
You could also modify PIPHP_CreateCaptcha() itself and introduce a few more (or use
different) image manipulations.
The Plug-in
function PIPHP_CreateCaptcha($size, $length, $font,
$folder, $salt1, $salt2)
{

122
P l u g - i n P H P : 1 0 0 P o w e r S o l u t i o n s

122
P l u g - i n P H P : 1 0 0 P o w e r S o l u t i o n s
$file = file_get_contents('dictionary.txt');
$temps = explode("\r\n", $file);
$dict = array();

foreach ($temps as $temp)
if (strlen($temp) == $length)
$dict[] = $temp;

$captcha = $dict[rand(0, count($dict) - 1)];
$token = md5("$salt1$captcha$salt2");
$fname = $folder . $token . ".gif";

PIPHP_GifText($fname, $captcha, $font, $size, "444444",
"ffffff", $size / 10, "666666");
$image = imagecreatefromgif($fname);
$image = PIPHP_ImageAlter($image, 2);
$image = PIPHP_ImageAlter($image, 13);

for ($j = 0 ; $j < 3 ; ++$j)
$image = PIPHP_ImageAlter($image, 3);
for ($j = 0 ; $j < 2 ; ++$j)
$image = PIPHP_ImageAlter($image, 5);

imagegif($image, $fname);
return array($captcha, $token, $fname);}
Check Captcha
Once you have created a Captcha image and asked a user to type it in you can use this plug-
in to verify their input, and determine whether they entered the correct word. Figure 6-4
shows the plug-in being used.
FIGURE 6-4 This plug-in verifies a Captcha word entered by a user.

34
C h a p t e r 6 : F o r m s a n d U s e r I n p u t
123
C h a p t e r 6 : F o r m s a n d U s e r I n p u t
123
About the Plug-in
This plug-in verifies the Captcha word input by a user, in response to a request made using
a Captcha created with plug-in 33, PIPHP_CreateCaptcha(). It takes these arguments:
• $captcha The Captcha as typed in by a user
• $token The token representing the current Captcha
• $salt1 The first salt string

• $salt2 The second salt string
Variables, Arrays, and Functions
• None
How It Works
The first thing this function does is remove the Captcha GIF image from the hard disk, if it
still exists, and then returns the result of recreating the md5() hash from plug-in 33, based
on the user string provided in $captcha, and the two salts in $salt1 and $salt2.
As long as the salts are the same as when the Captcha was created, if the user has typed
in the correct hash word, then the result of concatenating all three and passing them to the
md5() function will be the same as the value stored in $token. In which case a value of
TRUE is returned. Otherwise, the correct word was not entered and FALSE is returned.
How to Use It
After a Captcha has been created using the previous plug-in, you will have been provided
with the location of a GIF image and a token representing the Captcha. Using these you will
then have displayed the image and provided a web form requesting that the user type in
the word in the Captcha image. This form will now have been posted to your server and the
two items of data received will be:
• $_POST['captcha'] The Captcha text entered by the user
• $_POST['token'] The token embedded in the hidden form field
Using these values, the following example code will verify the Captcha word as enter
ed
by the user.
if (PIPHP_CheckCaptcha($_POST['captcha'], $_POST['token'],
'!*a&K', '.fs£!+')) echo "Captcha verified";
else echo "Captcha failed";
Note that the two salts are not passed as arguments because they are a secret and only
your code should know them. Just ensure that you use the same salts for both PIPHP_
CreateCaptcha() and PIPHP_CheckCaptcha() or the plug-ins won’t work.
If you wish to test the example code (testcaptcha.php) in the previous plug-in, type in
the preceding example and save it as checkcaptcha.php and it will verify the result of using the

Captcha. Both of these programs can be found in a folder named 6 of plug-ins.zip available
using the Download link at pluginphp.com. By the way, the file plugin34.php, which is in the

124
P l u g - i n P H P : 1 0 0 P o w e r S o l u t i o n s

124
P l u g - i n P H P : 1 0 0 P o w e r S o l u t i o n s
same folder of the zip file, simulates creating a Captcha, posting it, and verifying it, all in a
single program.
After a while you will find that your folder of Captcha images gets quite full. You may
therefore wish to use code, such as the following, to clear these files out every now and then:
foreach (glob("*.gif") as $file)
if (time() - filectime($file) > 300)
unlink($file);
What the code does is use the glob() function to search for all files with a .gif extension
and then, if they are more than 5 minutes (300 seconds) old, they are removed using the
unlink() function. If the files are in a different folder then you should ensure that you have
first assigned that name to a variable called $folder, and that it has a trailing /, for example,
using a value such as images/ if your folder is called images. Then you can use the following
code instead:
foreach (glob($folder . "*.gif") as $file)
if (time() - filectime($file) > 300)
unlink($file);
The Plug-in
function PIPHP_CheckCaptcha($captcha, $token,
$salt1, $salt2)
{
return $token == md5("$salt1$captcha$salt2");
}

Validate Text
Processing user input takes a lot of work, especially when you need data to be in a certain
format or to fit within various constraints. Using this plug-in you can check user input to
ensure it is the right length and contains the right types of data, whether alphabetical,
numeric, or something else.
It’s also highly versatile, allowing you to specify the allowed characters (and therefor
e
those that are disallowed), as well as types of characters that must be used. Figure 6-5
shows two different strings being validated.
About the Plug-in
This plug-in accepts a string to be validated, along with parameters describing what is and
isn’t allowed in the string. The function returns a two-element array on failure. The first of
which is the value FALSE; the second is an array of error messages. On success, it returns a
single element with the value TRUE. It takes these arguments:
• $text The text to be validated
• $minlength The minimum acceptable length
• $maxlength The maximum acceptable length

35
C h a p t e r 6 : F o r m s a n d U s e r I n p u t
125
C h a p t e r 6 : F o r m s a n d U s e r I n p u t
125
• $allowed The characters that are allowed in the text. Any characters can be
entered here, including ranges indicated by using a - character, such as a-zA-Z.
• $required Types of characters of which at least one of each must be in the text,
out of a, l, u, d, w, and p which, in order, stand for any letter, lowercase, uppercase,
digit, word (any letter or number), or punctuation.
Variables, Arrays, and Functions
$len Integer containing the length of $text

$error
Array of all error message strings
$result Integer result of matching the $allowed characters
$caught String containing matched characters from $allowed
$plural
String with the value “ is”, or “s are” if there is more than one match
$j
Loop counter
How It Works
This plug-in sets the value of $len to the length of $text, and after initializing the array
$error ready to hold any error messages, it checks whether $len is smaller or larger than
the required minimum and maximum lengths. If either is the case, a suitable error message
is added to the $error array.
Next the preg_match_all() function is called to check for the existence of any
characters not in the string $allowed, which contains a list of all allowed characters,
including supporting ranges created using the - character. Thus, instead of having to use
the string abcde, the equivalent of a-e is allowed; so, for example, to accept all upper- and
lowercase letters, the string a-zA-Z could be used.
FIGURE 6-5 Processing form input is now easier than ever using this plug-in.