Integrating google reCaptcha into an existing payment form

Question

recently my site has been receiving a lot of spam through my payments form and I've decided I need to add a captcha in order to prevent this.

I was looking at a few options and I decided to go with Googles reCaptcha. It seems easy enough to set up and use but I've been running into a few problems.

Firstly I've included this script in the header of the form:

<script src='https://www.google.com/recaptcha/api.js'></script>

I've then included the actually captcha itself at the foot of the form:

<div class="g-recaptcha" data-sitekey="6LdOVv4SAAAAAJ4muJvo_vD7vsd9T9QIfkEwcO7y"></div>

When I submit the form I do the following:

$captcha = $_POST["g-recaptcha-response"]; //Get Captcha token
$secret_key = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; //Get Secret key
$google_response = http_get("https://www.google.com/recaptcha/api/siteverify", array("secret"=>$secret, "response"=>$captcha), $info); //perform Get request
print_r($info);

But nothing is happening, in fact the page which used to work just hangs and doesn't even display an error message. Any ideas what I might be doing wrong? From my understanding of the documentation, the response will be in JSON and success will either be true or false, I'd like to continue with the payment if true or stop and return to the form if false.

any help is much appreciated. Or if anyone has an alternative solution to adding a captcha I'd be willing to look into that.

Answer 1

Try this to run google new recaptcha 2015:

==PHP Verification==
if(isset($_POST['submit'])){
    $userIP = $_SERVER["REMOTE_ADDR"];
    $recaptchaResponse = $_POST['g-recaptcha-response'];
    $secretKey = "SECRET_KEY";
    $request = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret={$secretKey}&response={$recaptchaResponse}&remoteip={$userIP}");

    if(!strstr($request, "true")){
        echo "NOPE (Failed Verification)";
    }
    else{
        echo "YUP (Successful Verification)";
    }
}

Answer 2

Don't use file_get_contents. Google recommends to use POST-Requests to call their api. GET-Requests like above can result in multiple problems:

• it might be blocked to call on urls due to security (allow_url_fopen)
• a user might pass something like someToken&secret=otherSitesSecret as input to your $_POST[g-recaptcha-response]. If you simply string concat the called url, you will pass another secret to Google. Users can then verify themselves with any recaptcha response they got from any site. That is a security issue.
• the tokens that Google returns can be quite long. Webservers only support a few thousand characters in urls. This might lead to strings chopped off and you will receive an error for valid inputs.

Therefore, use something like this:

// Get resource
$curl = curl_init();

// Configure options, incl. post-variables to send.
curl_setopt_array($curl, array(
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_URL => 'https://www.google.com/recaptcha/api/siteverify',
    CURLOPT_POST => 1,
    CURLOPT_POSTFIELDS => array(
        'secret' => 'your_secret_code_here',
        'response' => $_POST['g-recaptcha-response']
    )
));

// Send request. Due to CURLOPT_RETURNTRANSFER, this will return reply as string.
$resp = curl_exec($curl);

// Free resources.
curl_close($curl);

// Validate response
if(strpos($resp, '"success": true') !== FALSE) {
    echo "Verified.";
} else {
    echo "Not verified.";
}

Also, the validate part is more conservative in what it accepts as 'validated'.