如何通过recaptcha检查HTML表单中的数据？

Question

I'm working on a contact website, where I want to have contact form. I want it to send data to e-mail and I want it to be checked by Google's recaptcha v3.

This is my second try. In the past, I've done it successfully without recaptcha. Now, I used this (https://codeforgeek.com/google-recaptcha-v3-tutorial/) tutorial, with following result:

script below the form

       // when form is submit
    $('#myform').submit(function() {
        // we stoped it
        event.preventDefault();
        var mail = $('#email').val();
        var comment = $("#sprava").val();
        // needs for recaptacha ready
        grecaptcha.ready(function() {
            // do request for recaptcha token
            // response is promise with passed token
            grecaptcha.execute('__SITE-KEY__', {action: 'create_comment'}).then(function(token) {
                // add token to form
                $('#myform').prepend('<input type="hidden" name="g-recaptcha-response" value="' + token + '">');
                    $.post("form.php",{mail: mail, comment: comment, token: token}, function(result) {
                            if(result.success) {
                                    alert('Thanks for message')
                            } else {
                                    alert('An error occured')
                            }
                    });
            });;
        });
  });
  </script>

the names of html form fields are "email", "vyber", "sprava"

form.php

<?php
  $mail;$comment;$captcha;
  $mail = filter_input(INPUT_POST, 'mail', FILTER_VALIDATE_EMAIL);
  $comment = filter_input(INPUT_POST, 'comment', FILTER_SANITIZE_STRING);
  $captcha = filter_input(INPUT_POST, 'token', FILTER_SANITIZE_STRING);
  }

  function email_sending(){
    $webmaster_email = "[e-mail]";
    $sender_email= "[e-mail]" ;

    $email_address = $_REQUEST['email'] ;
    $selection = $_REQUEST['vyber'] ;
    $message = $_REQUEST['sprava'];

    $msg =
    "E-mail: " . $email_address . "
" .
    "I'm interested in " . $selection . "
" .
    "Message: " . $message ;


    mail( "$webmaster_email", "You have mail", $msg, $header);
  }

  if($responseKeys["success"]) {
    echo json_encode(array('success' => 'true'));
    email_sending();
  } else {
    echo json_encode(array('success' => 'false'));
  }
?>

The problem isn't within recaptcha part, but then I recieve e-mail, where data is missing. (it shows only variable names, not actual values). I might think it's because of naming in script, as I'm not sure what to write in declaration of variables. I'd be glad to receive any input about this problem.

Answer 1

I managed to solve this problem by changing server-side code like below, thanks to this Recaptcha tutorial.

  // Check if form was submitted:
  if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['recaptcha_response'])) {

// Build POST request:
$recaptcha_url = 'https://www.google.com/recaptcha/api/siteverify';
$recaptcha_secret = '__SECRET-KEY___';
$recaptcha_response = $_POST['recaptcha_response'];

// Make and decode POST request:
$recaptcha = file_get_contents($recaptcha_url . '?secret=' . $recaptcha_secret . '&response=' . $recaptcha_response);
$recaptcha = json_decode($recaptcha);

// Take action based on the score returned:
if ($recaptcha->success == true) {
    // Verified - send email

} else {
    // Not verified - show form error

}

}