Wednesday, March 18, 2009

How CAPTCHA Works? And a Simple Script in PHP

[For this post I'm presuming that you are familiar with CAPTCHA, if not please read this Introduction to CAPTCHA]

CAPTCHA Image Generated by Our ScriptToday we are going to see how CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) works and how it minimizes automatic sign-up of forms. We will also be creating a simple CAPTCHA script in PHP to illustrate this.

Basically CAPTCHA works in the following manner:

  1. Create Random Value: Some random string is generated, random values are often hard to guess and predict.

  2. Generate an Image: Images are used as these are generally a lot harder to read for computers while being nice and readable to humans. This is also the most important step as simple text in images can be read (and CAPTCHA cracked) quite easily. To make it difficult for them, developers employ different techniques so that the text in the image becomes hard to read for computers. Some create zig-zag lines for background while others twist-and-turn individual characters in the image. Possibilities are many and new techniques are being developed all the time as crackers are always into finding ways to break them.

  3. Store it: The random string generated (which is also in the image) is stored for matching the user input. The easiest way to do so is to use the Session variables.

  4. Matching: After the above step, the CAPTCHA image is generated and shown on some form which we want to protect from being abused. The users fills in the form along with the CAPTCHA text and submits it. Now we have the following:

    1. All submitted form data.

    2. CAPTCHA string (from form), input by user.

    3. CAPTCHA string (real one, generated by us), from session variable. Session variable is generally used as it can keep stored values across page requests. Here, we needed to preserve stored values from one page (form page) to another (action page-that receives form data).

  5. If both match, it's okay otherwise not, in that case we can give the user a message that the CAPTCHA they had entered was wrong and their form could not be submitted. You could also ask them to verify it again.

The following image might illustrates this better:

CAPTCHA Generation and Matching
How CAPTCHA is Generated and Matched

From the above image it's quite clear that when someone requests the form page, the CAPTCHA text is generated and sent back to requesting user, but only in the form of an image. If the requester is a human he'd not have much difficulty reading the image and inputting the text when asked but if it's a bot it might face difficulties guessing whats in the image. In the next step when we match the string generated and the one the user had input, we can restrict automated form submissions.

The following is the code that does this, it'll just output the CAPTCHA image to the browser when the script is requested:

 * File:        captcha.php                             *
 * Author:      Arvind Gupta (    *
 * Date:        12-Mar-2009                             *
 * Description: This file can be embedded as image      *
 *              to show CAPTCHA/                        *

// The number of characters you
// want your CAPTCHA text to have
define('CAPTCHA_STRENGTH', 5);

 *        INITIALISE        *
// Tell PHP we're going to use
// Session vars

// Md5 to generate the random string
$random_str md5(microtime());

// Trim required number of characters
$captcha_str substr($random_str, 0, CAPTCHA_STRENGTH);

// Allocate new image
$width = (CAPTCHA_STRENGTH * 10)+10;
$height 20;

$captcha_img =ImageCreate($width$height);

// Background color-black
$back_color ImageColorAllocate($captcha_img000);

// Text color-white
$text_color ImageColorAllocate($captcha_img255255255);

// Line color-red
$line_color ImageColorAllocate($captcha_img25500);

 *     DRAW BACKGROUND &    *
 *           LINES          *
// Fill background color

// Draw lines accross the x-axis
for($i = 0; $i <
$width; $i += 5)
ImageLine($captcha_img, $i, 0, $i, 20, $line_color);

// Draw lines accross the y-axis
for($i = 0; $i < 20; $i += 5)
ImageLine($captcha_img, 0, $i,
$width, $i , $line_color);

 *      DRAW AND OUTPUT     *
 *          IMAGE           *
// Draw the random string

// Carry the data (KEY) through session
$_SESSION['key'] = $captcha_str;

// Send data type
header("Content-type: image/jpeg");

// Output image to browser

// Free-Up resources

Okay, this it for this, in the next one we'll integrate this CAPTCHA script into one form and see how it works. Till then goodbye!


  1. Anonymous10:51 AM

    Nice Topic

    I hope you take a look to my blog

    It is about FREE eBooks


  2. Nice Article...useful message is shared in this.


  3. Though I know that capcha is used to avoid spamming I am really happy to know how it work and what is the code required to create a capcha image. Thanks to you.

  4. Really helpful especially to those who are receives hundreds of emails through their contact form

  5. Anonymous10:47 PM

    u provided the nice topic and i want to know more how the computers can access the free email and how spammers can attack the emails and e-commerce applications.

  6. im really impressed with this but if i want to make texts a little bit zigjag like in yahoo or gmail or recaptcha provided by google or also facebook then what to do??


You are free to comment anything, although you can comment as 'Anonymous' it is strongly recommended that you supply your name. Thank You.

Please don't use abusive language.