verify the google recapture server php
i was still getting quite a bit of spam even after using google recapture v2 and i think this is just as i was using the javascript only version, which disables the submit button if the capture is not solved.
the issue with this is all you need to do is disable javascript and you can still submit the form, so it needs some server side verification to check that the capture is actually solved.
I added this code to the post back on the form to send a check back to google which verifies the capture is solved
I also found that this cases the form to take a while to submit, so it needs some intervention from jquery. As when the form is submitted it has to wait to get the response from google. When its submitted you have to hide the submit button on the form and replace it with a disabled button that has please wait on it.
here is a demo of its functionality
verify google recapture
HTML
<form id="subform" method="post">
<button type="submit" class="btn btn-success" id="commentButton" disabled="disabled">Register</button>
<button class="btn btn-primary hide" disabled="disabled" id="pleaseWait">Please Wait...</button>
</form>
Javascript
$(document).ready(function(){
/* hide submit buttons on form clicks */
$('#subform').on('submit', function(evt) {
$('#commentButton').hide();
$('#pleaseWait').show();
});
});
PHP
if($_SERVER['REQUEST_METHOD']=="POST") {
// check google recp auth
$bad_google_cap = "<p class='alert alert-warning'>Recapture Failed</p>";
if(isset($_POST['g-recaptcha-response'])) {
$cap_response = $_POST['g-recaptcha-response'];
} else {
$page_content .= $bad_google_cap;
return;
}
$google_response = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=____your_secret_key_____&response=".$cap_response."&remoteip=".$_SERVER['REMOTE_ADDR']);
$google_response_decoded = json_decode($google_response);
if(!$google_response_decoded->success === true) {
$page_content .= $bad_google_cap;
return;
}
// check google recp auth
}