PHP：将类实例传递给另一个页面？

Question

I'm trying to implement a captcha system, and I found a nice and very simple class trough google that does what I want.

it's something like:

$captcha = new Captcha();
$prefix = mt_rand();
$image = $captcha->generate($prefix);

then I add the image in the form:

<img src="<?php echo $image; ?>" />
<input name="captcha" type="text" value="Type the security code from above" />

it works fine so far, but I don't know how to check if the submitted code matches the captcha. In the documentation, it says I have to do it with:

$correct = $captcha_instance->check($prefix, $_POST['captcha']);

but the problem is that after the form is submitted $captcha and $prefix are gone...

How do I pass these variables after the form is submitted to the next page?

Answer 1

@mario: you were right :D it's only the $prefix I needed to pass as a hidden input field :)

That's a very bad idea - in your form tag, if say you have hidden field captcha_answer and you're passing the value of that to $captchaInstance->check(), then you defeat the purpose of a captcha. Captcha's are to sort out robots from humans, but its so simple to read a value by downloading the source in the captcha solving bot and just getting the value="{answer}" out of the source.

Instead, you should use this:

<?php
session_start();
$_SESSION['answer'] = $prefix;
?>

Then in your checker you do this:

<?php
session_start();
$prefix = $_SESSION['answer'];
$passed = $captcha->check($prefix);
?>

In fact, I think this class would be better as only having static methods, but that's my opinion. Anyway, this way means that all the data is only stored server-side so they can't just view source for captcha answer.