How well do you think this will work for the most part.
CODE
session_start();
$sessid = session_id(); // returns sessions id
session_regenerate_id(); // gives the session a new id
session_destroy(); // ends the session, only do this if session isn't needed obviously.
$sessid = substr($sessid,-8); // cuts the variable sessid to have only 8 characters left.
$sessid = session_id(); // returns sessions id
session_regenerate_id(); // gives the session a new id
session_destroy(); // ends the session, only do this if session isn't needed obviously.
$sessid = substr($sessid,-8); // cuts the variable sessid to have only 8 characters left.
Then you would create a form...
CODE
<form action="dothis.php" method="post">
//give sessid it's own value in the form
<input type="hidden" name="sessid" value="<?php echo $sessid;?>">
// REST OF FORM HERE
// REST OF FORM HERE
Enter the security code: <?php echo $sessid; ?><br>
<input type="text" name="security"><br>
<input type="submit">
//give sessid it's own value in the form
<input type="hidden" name="sessid" value="<?php echo $sessid;?>">
// REST OF FORM HERE
// REST OF FORM HERE
Enter the security code: <?php echo $sessid; ?><br>
<input type="text" name="security"><br>
<input type="submit">
And then you check the security code, if wrong send back to previous page w/ error code... The following would obviously be "dothis.php"
CODE
$sessid = $_POST['sessid'];
$security = $_POST['security'];
if ($sessid != $security)
{
echo ?>
RELOCATION CODE HERE
<?php
}
else
{
//else if $sessid does equal $security, then finish the code.
}
$security = $_POST['security'];
if ($sessid != $security)
{
echo ?>
RELOCATION CODE HERE
<?php
}
else
{
//else if $sessid does equal $security, then finish the code.
}
You can see a working version of this on my contact/FAQ page on my site (http://www.creactiveonline.com) - it works against inputting the wrong code, but would it stop an actual bot in your opinion?
NOTE: I always like to use sessid because I, personally, do not know how to generate a completely random string with letters and #'s like sessid does - so i basically use sessid for everything (my chat rooms, for instance). This one i just chop it down to 8 characters. If you know how to generate random # and letter string, i'm sure it'll work the same for you if you used that instead of the session id.
