how to keep custom form "security code" out of the page source

Hello,

I am wanting to use a maths question as a security code for an eForm form instead of captcha.

I am wondering if there is a way to include the required code (eg "2") in the eForm call rather than showing the value in the form / page source?

If I ask 1 + 1 = ...

And the answer is 2.

And the form hidden field would be something like:

<input type="hidden" name="Security Code" value="" eform="Security Code:integer:1:That answer is incorrect - please try again:#LIST 2" />

How do I keep that off the screen?

Thanks and all the best.

You can look at the code of the SPForm snippet, which has the option to generate a random math equation for the Captcha image.

Really, the only safe way to do it is to rewrite veriword.php to generate the equation, solve it, write the answer to a $_SESSION variable, and create an image from the equation. Later, the user’s input is checked against that $_SESSION variable.

Remember, too, that unless your equation is complex enough to annoy the user, it will be somewhat susceptible to brute force attacks that just try random numbers.

Hi BobRay,

Thanks for that - sounds complex doing the veriword.php!! (for me anyways)

I use this other formmail program outside of MODx (http://www.tectite.com/) and it is brilliant for anti spam options.

The math function in SPForm might be the go though it looks quite involved to setup. But if it works, could be exactly what I am after.

The reason I want to have a math / number question is because the language will be changing dynamically based on user flag selection and the captcha codes don’t seem to change characters (and hence a form might not be able to be sent if on a chinese keyboard) - whereas numbers are more universal.

Unless of course, there’s a numbers only captcha option?

Thanks again.

Quote from: nickf08 at Dec 11, 2008, 02:12 AM

Hi BobRay,

Thanks for that - sounds complex doing the veriword.php!! (for me anyways)

I use this other formmail program outside of MODx (http://www.tectite.com/) and it is brilliant for anti spam options.

The math function in SPForm might be the go though it looks quite involved to setup. But if it works, could be exactly what I am after.

The reason I want to have a math / number question is because the language will be changing dynamically based on user flag selection and the captcha codes don’t seem to change characters (and hence a form might not be able to be sent if on a chinese keyboard) - whereas numbers are more universal.

Unless of course, there’s a numbers only captcha option?

Thanks again.

in the modx settings you can make your own captcha words that ofcourse could be numbers instead.

Hi Dimmy,

Good thinking - wish I thought of that!!
I think that’s what I will do.
Genius in simplicity!
Thanks so much.

Well, SPForm is actually pretty easy to set up, though it’s limited to just being a plain contact form that you can’t really alter. eForm is much more flexible. SPForm does have a wide selection of antispam features in addition to Captcha (in fact, if you turned all the others on, you might not need captcha -- which would be good).

Here’s another thought. I’m pretty sure that the default captcha in MODx uses the captcha words system setting (Tools | Configuration | User tab) so you can edit them. It picks one of the words at random and, iirc, it adds a three-digit random number to the end of it. If you changed the captcha words to be all two- or three-digit numbers, I think you’d get a captcha image with 5 or 6 numbers and no letters.

Ah thanks for clearing that up BobRay. I need to customise some fields so will run with eForm.

Great suggestion - I will plug in the numbers in the configuration setting.

Thanks very much and all the best.

p.s. just set it up with 1,2 through to 9 and its providing a 4 digit number.

it’s working a treat!

Thanks very much for your help.

Just thinking out loud here. Couldn’t we use eForm events to set the math question/answer? For example use a function on &eformOnBeforeFormParse to set the question and the answer and load them into session vars then another function on &eFormOnValidate to validate the answer. Has anyone tried this? I seem to recall a post on this way back but don’t think I bookmarked it.

Quote from: dev_cw at Dec 11, 2008, 06:12 AM

Just thinking out loud here. Couldn’t we use eForm events to set the math question/answer? For example use a function on &eformOnBeforeFormParse to set the question and the answer and load them into session vars then another function on &eFormOnValidate to validate the answer. Has anyone tried this? I seem to recall a post on this way back but don’t think I bookmarked it.

Another way to go would be to just replace veriword.php with the one from the captcha code from SPForm. IIRC, it will work with existing code and takes an extra argument that tells it to use the mathstring.

BTW, hacking veriword.php is often the easiest solution, IMO, because all it really does is generate the image and write the $_SESSION variable saving the answer. As long as it does those two things, it can’t break any existing code that uses it. Any other component that wants Captcha just calls it and then compares the users input against the $_SESSION variable.

The Revolution captcha package will use the mathstring in response to the system setting captcha_use_mathstring, iirc.