What are some best practices for implementing a CAPTCHA code in PHP to prevent spam bots?

Spam bots can easily submit forms on websites, leading to issues like fake registrations or comment spam. Implementing a CAPTCHA code in PHP can help prevent this by requiring users to prove they are human before submitting a form. 

```php
<?php
session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (isset($_POST["captcha"]) && $_POST["captcha"] == $_SESSION["captcha"]) {
        // CAPTCHA code is correct, process form submission
        // Add your form processing logic here
    } else {
        // CAPTCHA code is incorrect, display error message
        echo "CAPTCHA code is incorrect. Please try again.";
    }
}

// Generate a random CAPTCHA code and store it in session
$captcha = substr(md5(rand()), 0, 5);
$_SESSION["captcha"] = $captcha;

// Display the CAPTCHA image
echo '<img src="captcha.php" alt="CAPTCHA">';

// Include captcha.php file to generate CAPTCHA image
```

In the above PHP code snippet, we first start a session and check if the form is submitted via POST method. We then compare the user input with the CAPTCHA code stored in the session. If the codes match, the form submission is processed; otherwise, an error message is displayed. The CAPTCHA code is generated randomly and stored in the session. Finally, an image tag is used to display the CAPTCHA image, which is generated by a separate `captcha.php` file.

Keywords

CAPTCHA PHP spam bots implementation prevention

Related Questions