Javascript Captcha

Question

I found this great little code online but it doesn't seem to be comparing the two strings after removing the spaces correctly? I know some js but whatever wrong here is beyond my understanding. Hopefully someone will know the answer to this.

Note: it seems to also validate based on the number of chs and not what those chs are, the numbers dont seem to need to match up, just so long as there's enough of them.

Org code was done by "mama21mama" from "http://osticket.com/forums/showthread.php?t=6489&highlight=captcha"

I have made some small personal modifications to try to fix it, below is my vr.

<script type="text/javascript">
    function DrawCaptcha() {
        var a = Math.ceil(Math.random() * 9)+ '';
        var b = Math.ceil(Math.random() * 9)+ '';       
        var c = Math.ceil(Math.random() * 9)+ '';  
        var d = Math.ceil(Math.random() * 9)+ '';  
        var e = Math.ceil(Math.random() * 9)+ '';  
        var f = Math.ceil(Math.random() * 9)+ '';  
        var g = '10';  
        var code = a + ' ' + b + ' ' + ' ' + c + ' ' + d + ' ' + e + ' '+ f + ' ' + g;
        document.getElementById("txtCaptcha").value = code
    }
    function ValidCaptcha() { // valida los numeros ingresados
        var str1 = removeSpaces(document.getElementById('txtCaptcha').value);
        var str2 = removeSpaces(document.getElementById('txtInput').value);
        if (str1 == str2){
            return true; } 
        else {
            return false; } 
    }
    function removeSpaces(string) { 
        return string.split(' ').join('');
    } 
    </script>

It seems fine to me (enter the numbers, result of `ValidCaptcha` is alerted `onblur` of input): http://jsfiddle.net/APzxv/5/ — James Allardice, Sep 27 '11 at 16:24
This doesn't seem like a very secure captcha to me. One could easily rewrite `ValidCaptcha` to just return true. Hopefully others will chime in on that as I'm not a captcha expert. — Matt Greer, Sep 27 '11 at 16:35
Validating a CAPTCHA client side in this way would mean it would be easily bypassed. Related comment: http://stackoverflow.com/questions/1998341/captcha-validation-with-javascript/1998361#1998361 — mattle, Sep 27 '11 at 16:38
I need to add captcha to my form, is there an easier way to plug the function in? — webmaster alex l, Sep 27 '11 at 16:42
You can't do the captcha client side and have it be secure. It's entirely possible the captcha doesn't need to be that secure. But if it does, you need to do the validation on the server. You can always use an AJAX call to do that. — Matt Greer, Sep 27 '11 at 16:50

score 9 · Accepted Answer · answered Sep 27 '11 at 17:34

Do not use this code. It does nothing to increase security.

In order for a captcha to be effective, the answer to the captcha must be a secret known only by the server. A client-side script cannot implement a captcha because the client code would necessarily know the answer.

This script does nothing to secure your sever against a malicious attack. All the JavaScript in the world doesn't prevent an attacker from writing a script that POSTs a fake form to your server. Since the captcha validation happens on the client, your sever is clueless as to whether the request is legitimately generated by a human.

This captcha also misses the point by rendering the challenge as plain text. Any script could read the challenge from the DOM and provide the correct answer.

This script is useless if a browser has JavaScript disabled. This script is useless if I type ValidCaptcha = function() { return true; } in the console.

Instead of trying to roll your own, use reCAPTCHA. It is free, has an easy API, and has built-in accomodations for blind users.

Thanks, I was already working on that and I was able to add my own reCaptcha to my site. Its working great now. Thanks everyone for all the help :) Happy coding — webmaster alex l, Sep 27 '11 at 19:22
@StanE the site administrator needs one to [set up reCAPTCHA](https://www.google.com/recaptcha/admin), but your visitors do not need one. — josh3736, Nov 18 '15 at 03:02

Javascript Captcha

1 Answers1