PHP - question about using reCAPTCHA with jQuery

Question

Here is a tutorial that shows how to combine jQuery form validation with reCAPTCHA. http://snipplr.com/view/15563/jquery-validating-recaptcha-with-ajax/

Based on my understanding, the above tutorial actually performs client-side validation through aJax, which interacts with the reCAPTCHA script server.

After successful verification, I use the following code, borrowed from the comments:

$('#formID').validate({ submitHandler: function(form) { if(validateCaptcha()){ // Submit form offerForm.ajaxSubmit(); } } }); 

to submit the form and please see line 21 of the source code:

 $("form").attr("action", "http://action/to/the/form_handler.php"); 

My question is: should I MUST call recaptcha_check_answer inside form_handler.php with the parameters passed

 challengeField = $("input#recaptcha_challenge_field").val(); responseField = $("input#recaptcha_response_field").val(); 

If not, then a person can easily avoid reCAPTCHA by changing the verification procedure. It seems the same idea that we are always dealing with client + server validation.

Please correct my idea if I misunderstand.

// Give detailed information about the problem that I have ///

  <code> <form id="regFormBody" method="post" action="verify.php"> ... </code> $("#regFormBody").validate({ debug: true, errorPlacement: function (error, element) { error.insertAfter(element.parents('div.collection:first')); }, rules: { loginemail: { required: true, email: true, rangelength: [4, 32] }, password: { required: true, rangelength: [8, 30], passwordPattern: true }, confirmpassword: { required: true, rangelength: [8, 30], equalTo: "#password" } } } }); 

Here is my problem: If the form passes validation on the client side, then it does NOT run the verify.php file and stops after validation. thanks

Answer 1

Yes, that sounds right to me. Yes, you definitely need to check captcha on the server. I don’t like the idea of ​​captcha client side validation in general, and I don’t think you want to publish your reCaptchi API keys in a script that the user can get. I would also expect that the second check of the same captcha values ​​(your server-side check after the client-side check) will be rejected by recaptcha servers anyway (confirmation of this from the comment on the original blog) .

So, I think you need to publish captcha for your AJAX handler, and it should perform validation as well as your action. You can confirm that the user entered something for correspondence before sending it, but IMO you should not try and check it on the client side at all.