How to add reCAPTCHA v2 to an existing form using PHP? - php

Question

I want to integrate a recaptcha to my functioning contact form using PHP. The PHP form is already set, so I figured I should go that route. I believe
I have all necessary variables and parameters are set, I just need to know where exactly to place the final recaptcha verification in my PHP form.
I've tried several iterations of the code, but it essentially short-circuits and ruins the function of the existing code.
HTML:
<form action="php/contactform.php" method="post" role="form" class="contactForm" id="contactForm">
<div class="form-group">
<input type="text" name="name" class="form-control" id="name" placeholder="Your Name" data-rule="minlen:4" required />
</div>
<div class="form-group">
<input type="email" class="form-control" name="email" id="email" placeholder="Your Email" data-rule="email" required />
</div>
<div class="form-group">
<input type="text" class="form-control" name="subject" id="subject" placeholder="Subject" data-rule="minlen:4" required />
</div>
<div class="form-group">
<textarea class="form-control" name="message" id="message" rows="5" data-rule="required" required placeholder="Message"></textarea>
</div>
<div class="g-recaptcha" data-sitekey="SITEKEYCODEALREADYHERE"></div>
<div class="text-center"><button type="submit" name="submit">Send Message</button></div>
</form>
PHP:
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
// Get the form fields and remove whitespace.
$name = strip_tags(trim($_POST["name"]));
$name = str_replace(array("\r","\n"),array(" "," "),$name);
$subject = strip_tags(trim($_POST["subject"]));
$subject = str_replace(array("\r","\n"),array(" "," "),$subject);
$email = filter_var(trim($_POST["email"]), FILTER_SANITIZE_EMAIL);
$message = trim($_POST["message"]);
// Check that data was sent to the mailer.
if ( empty($name) OR empty($subject) OR empty($message) OR !filter_var($email, FILTER_VALIDATE_EMAIL)) {
// Set a 400 (bad request) response code and exit.
http_response_code(400);
echo "Oops! There was a problem with your submission. Please complete the form and try again.";
exit;
}
// Set the recipient email address.
// FIXME: Update this to your desired email address.
$recipient = "me#cbonilla.dev";
// Set the email subject.
$subject = "Subject: $subject";
// Build the email content.
$email_content = "Name: $name\n";
$email_content .= "Email: $email\n\n";
$email_content .= "Message:\n$message\n";
// Build the email headers.
$email_headers = "From: $name <$email>";
//reCAPTCHA Verification
$secretKey = "SECRETCODEALREADYHERE";
$responseKey = $_POST['g-recaptcha-response'];
$UserIP = $_SERVER['REMOTE_ADDR'];
$url = "https://www.google.com/recaptcha/api/siteverify?secret='.$secretkey.'&response='.$responseKey.'&remoteip='.$UserIP.'";
$response = file_get_contents($url);
$data = json_decode($response);
// Send the email.
if (mail($recipient, $subject, $email_content, $email_headers)) {
// Set a 200 (okay) response code.
http_response_code(200);
echo "Thank You! Your message has been submitted, fam.";
} else {
// Set a 500 (internal server error) response code.
http_response_code(500);
echo "Oops! Something went wrong and we couldn't send your message.";
}
} else {
// Not a POST request, set a 403 (forbidden) response code.
http_response_code(403);
echo "There was a problem with your submission, please try again.";
}
?>
I believe the final code snippet occurs after the "// Send the email." note. I've also already added the reCAPTCHA JS tag in the section.

Answer 1

You're missing the check. And this would go BEFORE the send message part. Something like this:
if(!empty($data["success"])) {
// You could put the actual sending of the mail in here. Or, not.
} else {
echo "Your captcha failed!";
exit();
}
The above would come right after your data = json_decode() line.
THAT answers your question. But, consider this. The doc for recaptcha (https://developers.google.com/recaptcha/docs/verify) says that you must use a POST when calling the api endpoint to verify the captcha. You can do this with a curl call, similar to the below:
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => 'https://www.google.com/recaptcha/api/siteverify',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => [
'secret' => $secretKey,
'response' => $captcha,
'remoteip' => $_SERVER['REMOTE_ADDR']
],
CURLOPT_RETURNTRANSFER => true
]);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response);