Why does email go through if Recaptcha is not checked? - php

Question

I have been trying my very hard to have recaptcha verify a user and not send the email without them being verified. I have tried everything I can possibly think of, but the email goes out from my contact form even if the checkbox is blank. My form still checks if the form's fields are empty or if a valid email address is entered, but I never get warned that recaptcha is not solved if the checkbox isn't touched. I tried just about every tutorial I can think of and even links from within the Stackoverflow community. Many thanks in advance.
FORM
<form action="mail.php" method="POST">
<h1>Contact</h1>
<input type="text" placeholder="First name" id="firstname" maxlength="50">
<br>
<input type="text" placeholder="Last name" id="lastname" maxlength="50">
<br>
<input type="text" placeholder="Email" id="email" maxlength="50">
<br>
<input type="text" placeholder="Subject" id="subject" maxlength="50">
<br>
<textarea id="message" name="message" placeholder="Message..." maxlength="120"></textarea>
<div class="g-recaptcha" data-callback="recaptchaCallback" data-sitekey="sitekey"></div>
<input type="submit" value="Submit" id="submit_button">
<br>
<p class="form-message"></p>
<?php if (isset($_GET['CaptchaFail'])){?>
<div class="form-error">You have not proven you are not a robot!</div>
<?php }?>
<script>
$(document).ready(function(){
$("form").submit(function (event) {
event.preventDefault();
var first = $("#firstname").val();
var last = $("#lastname").val();
var subject = $("#subject").val();
var email = $("#email").val();
var message = $("#message").val();
var submit = $("#submit_button").val();
$(".form-message").load("mail.php", {
first: first,
last: last,
subject: subject,
email: email,
message: message,
submit: submit
});
});
});
</script>
SERVER SIDE FIELD VALIDATION
<?php
if (isset($_POST['submit'])){
$first = $_POST['first'];
$last = $_POST['last'];
$email = $_POST['email'];
$subject = $_POST['subject'];
$message = $_POST['message'];
$submit = $_POST['submit'];
$errorEmpty = false;
$errorEmail = false;
if (empty($first) || empty($last) || empty($email) || empty($subject) || empty($message)){
echo "<span class='form-error'>Fill in all fields!</span>";
$errorEmpty = true;
}
elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
echo "<span class='form-error'>Write a valid email address!</span>";
$errorEmail = true;
}
else{
if(isset($_POST['submit'])){
$first = $_POST['first'];
$last = $_POST['last'];
$emailFrom = $_POST['email'];
$subject = $_POST['subject'];
$message = $_POST['message'];
$success = "<span class='form-success'>Message Success!</span>";
$emailTo = "ovalenzuela#itsmilvus.com";
$headers = "From: ".$emailFrom;
$txt = "You have received an email from ".$first . ' '.$last."\n\n".$message;
mail($emailTo, $subject, $txt, $headers);
echo "<span class='form-success'>$success</span>";
}
}
}
elseif (isset($_POST['submit'])){
}
else{
echo "There was an error!";
}
?>
<script>
var thanks = '<div>Thank you for you message!</div><br><Return to main page';
$("#firstname, #lastname, #email, #subject, #message").removeClass("input-error");
var errorEmpty = "<?php echo $errorEmpty; ?>";
var errorEmail = "<?php echo $errorEmail; ?>";
if (errorEmpty == true){
$("#firstname, #lastname, #email, #subject, #message").addClass("input-error");
}
if (errorEmail == true){
$("#email").addClass("input-error");
}
if (errorEmpty == false && errorEmail == false){
$("#firstname, #lastname, #email, #subject, #message").val("");
$("#contact-form").html(thanks).addClass("form-success");
}
</script>
RECAPTCHA VALIDATION (This is in the contact.php file.)
<?php
if (isset($_POST['submit'])){
$url = "https://www.google.com/recaptcha/api/siteverify";
$privatekey = "secretkey";
$response = file_get_contents($url."?secret=".$privatekey."&response=".$_POST['g-recaptcha-response']."&remoteip".$_SERVER['REMOTE_ADDR']);
$data = json_decode($response);
if (isset($data->success) AND $data-success == true){
header('Location:contact.php?CaptchaPass==true');
}
else{
header('Location:contact.php?CaptchaFail==true');
}
}
?>

Answer 1

After reading all of the comments things started to make more sense. Ended up validating the recaptcha from the front end and then wrote the server side code to make it happen.
Here is the PHP logic I used to fix the issue that I got when recpatcha was left blank:
if (empty($first) || empty($last) || empty($email) || empty($subject) || empty($message)) {
echo "<br><span class='form-error'>Fill in all fields!</span>";
$errorEmpty = true;
} // Validate if an email is entered
elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
echo "<span class='form-error'>Write a valid email address!</span>";
$errorEmail = true;
}
elseif (isset($data->success) && $data->success==true) {
$rescapStatus = true;
}
elseif (!empty($_POST['recaptcha'])) {
// echo('<p class="form-error"> Please set recaptcha variable.</p>');
$recapBox = true;
}
else {
$emailTo = "ovalenzuela#itsmilvus.com";
$headers = "From: " . $emailFrom;
$txt = "You have received an email from " . $first . ' ' . $last . "\n\n" . $message;
mail($emailTo, $subject, $txt, $headers);
}
}
else{
echo "There was an error!";
}
?>
<script>
var thanks = '<div>Thank you for you message!</div><br><Return to main page';
$("#firstname, #lastname, #email, #subject, #message").removeClass("input-error");
var errorEmpty = "<?php echo $errorEmpty; ?>";
var errorEmail = "<?php echo $errorEmail; ?>";
var recapStatus = "<?php echo $recapStatus; ?>";
var recapBox = "<?php echo $recapBox; ?>";
if (errorEmpty == true){
$("#firstname, #lastname, #email, #subject, #message").addClass("input-error");
}
if (errorEmail == true){
$("#email").addClass("input-error");
}
if (errorEmpty == false && errorEmail == false && recapBox == false){
$("#firstname, #lastname, #email, #subject, #message").val("");
$("#contact-form").html(thanks).addClass("form-success");
}
</script>