validate and saving random generated code php - php

Question

I have this simple php code that generate a random code and display it to the user. I need to verify using a text input if the user insert the displayed code, like a captcha, but i will use this script to redirect the user after the verification,to the registration form page. The code is generated, but i can't verify it, maybe i've missed something in the code?
NB: This is not a spam prevention system. As said in the comments, there are valid solution better than this to prevent spam. This is a starting draft for an user invitation system, if you want to downvote the question please consider this.
<?php
function randomCode() {
$code_variable = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz0123456789";
srand((double)microtime() * 1000000);
$i = 0;
$rand_Code = '';
while ($i <= 7)
{
$num = rand() % 33;
$tmp = substr($code_variable, $num, 1);
$rand_Code = $rand_Code . $tmp;
$i++;
}
return $rand_Code;
}
$code = randomCode();
if(isset ($_POST['verify'])){
if($_POST['user_code'] == $code ){
echo 'Valid code.';
header('Location: index.php');
}
}
?>
<form method="post" action="">
<input type="text" name="verification_code" disabled value="<? echo $code;?>">
<input type="text" name="user_code">
<button type="submit" name="verify">Verify code</button>
</form>

Answer 1

You will never get Valid code. being displayed on the screen since every time user clicks on Verify code button, the page will refresh and a new random captcha code will get generated and stored in $code. So that's why $_POST['user_code'] will never be equal to $code.
One workaround would be to append the captcha code in the URL itself, so that you could verify the authenticity of user-inputted captcha by comparing it with $_GET[...] data. So you need to change your form in the following way,
<form method="post" action="?captcha=<?php echo $code; ?>">
<input type="text" name="verification_code" disabled value="<?php echo $code;?>">
<input type="text" name="user_code">
<button type="submit" name="verify">Verify code</button>
</form>
Subsequently, verify captcha in the following way,
// your code
if(isset ($_POST['verify'])){
if($_POST['user_code'] == $_GET['captcha'] ){
// your code
}
}
Sidenote(s):
Don't output anything before the header(...); statement, otherwise you would see headers already sent error. Go through this SO thread to get more info on this.
header(...); alone is not sufficient to redirect the user to a different page, use exit(); after header(...); statement.

Answer 2

I've added the php mail() function to send the invitation code to users. It's working fine, i've divided the code into two parts. the first one manage the user invitation code sending:
<form method="post" action="?invitation=<?php echo $code; ?>">
<label for="email">Email</label>
<input type="text" name="email">
<button type="submit" name="send_invitation">Send invitation code</button>
</form>
<?php
session_start();
ob_start();
if(isset($_POST['send_invitation'])){
function randomCode()
{
$code_variable = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz0123456789";
srand((double)microtime() * 1000000);
$i = 0;
$rand_Code = '';
while ($i <= 7)
{
$num = rand() % 33;
$tmp = substr($code_variable, $num, 1);
$rand_Code = $rand_Code . $tmp;
$i++;
}
return $rand_Code;
}
$_SESSION['code'] = randomCode();
$_SESSION['tmp_mail'] = $_POST['email'];
if(isset($_POST['verify'])){
$to = $_POST['email']; // this is your Email address
$from = "noreply#domain.com"; // this is the sender's Email address
$subject = "Affiliate invitation code";
$message = $_SESSION['code'] . " " . " is your invitation code.";
$headers = "From:" . $from;
mail($to,$subject,$message,$headers);
echo "Mail Sent. Thank you " . $first_name . ", we will contact you shortly.";
}
?>
The second part of the script is on another page and manage the check for the code matching between stored code into the $_SESSION['code'] variable and the user input
<?php
session_start();
ob_start();
function redirect(){
header('refresh:3; url=affiliate/index.php');
exit;
}
if(isset($_POST['verify'])){
if($_POST['user_code'] == $_SESSION['code']){
echo "Valid invitation code. You can now register using $_SESSION['tmp_mail'] email address.";
} else { echo "Wrong code. Please enter a valid code or request a new one."; }
?>
<form method="post" action="?invitation=<?php echo $code; ?>">
<label for="Code">Invitation Code</label>
<input type="text" name="user_code">
<button type="submit" name="verify">Send invitation code</button>
</form>