WordPress Contact Form Validation Including Google reCaptcha Validation Issue - php

Question

I've been busy this morning creating a custom WordPress contact page template and have added the new Google reCaptcha to it in an effort to reduce spammers. I have created a validation.php file which the contact page actions to validate that all fields and the Google reCaptcha are correct. The problem is it just isn't working for me. I have everything setup as it should be in the WordPress file system and WordPress is navigating to the validation.php file no problem which leads me to believe that my validation code isn't working. Please see below:
HTML CODE:
<div class="col-xs-12 col-sm-8 col-lg-9">
<script src='https://www.google.com/recaptcha/api.js'></script>
<div id="content" role="main">
<?php get_template_part('includes/loops/content', 'page'); ?>
<hr/>
<form action="validate-contact-form.php" id="contactForm" method="post">
<fieldset>
<legend>Contact Us</legend>
<div class="form-group">
<div class="col-md-12">
<input id="cf-name" name="contactName" type="text" placeholder="Please enter your full name here." class="form-control" required=""/>
</div>
</div>
<br /><br />
<div class="form-group">
<div class="col-md-12">
<input id="cf-email" name="email" type="text" placeholder="Please enter your e-mail address here." class="form-control" required="" />
</div>
</div>
<br /><br />
<div class="form-group">
<div class="col-xs-12">
<textarea class="form-control" id="comments" placeholder="Please enter your message here." name="comments" rows="20" class="form-control" required="" ></textarea>
</div>
</div><hr/>
<div class="form-group">
<div class="col-xs-12"><hr/>
<div class="g-recaptcha" data-sitekey="6Ld6cf4SAAAAABBYX2C3I5Ayx_xLwKSYm2ZUtxen" class="form-control" required=""></div>
</div>
</div>
<div class="form-group">
<div class="col-xs-12"><hr/>
<button type="submit" name="submit" value="Send" class="btn btn-primary">Send Message</button>
</div>
</div>
</fieldset>
</form>
</div><!-- /#content -->
</div>
Validation.php CODE:
<?php
if(isset($_POST['submit'])) {
if(trim($_POST['contactName']) === '') {
$nameError = 'Please enter your name.';
$hasError = true;
} else {
$name = trim($_POST['contactName']);
}
if(trim($_POST['email']) === '') {
$emailError = 'Please enter your email address.';
$hasError = true;
} else if (!preg_match("/^[[:alnum:]][a-z0-9_.-]*#[a-z0-9.-]+\.[a-z]{2,4}$/i", trim($_POST['email']))) {
$emailError = 'You entered an invalid email address.';
$hasError = true;
} else {
$email = trim($_POST['email']);
}
if(trim($_POST['comments']) === '') {
$commentError = 'Please enter a message.';
$hasError = true;
} else {
if(function_exists('stripslashes')) {
$comments = stripslashes(trim($_POST['comments']));
} else {
$comments = trim($_POST['comments']);
}
}
if(isset($_POST['g-recaptcha-response'])&&$_POST['g-recaptcha-response']){
var_dump($_POST);
$secret = 'MY SITE KEY';
$ip = $_SERVER['REMOTE_ADDR'];
$captcha = $_POST['g-recaptcha-response'];
$rsp = file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret=$secret&response=$captcha&remoteip=$ip');
var_dump($rsp);
$array = json_decode($rsp, TRUE);
if($array['success']) {
}
}
if(!isset($hasError)) {
$emailTo = get_option('tz_email');
if (!isset($emailTo) || ($emailTo == '') ){
$emailTo = get_option('admin_email');
}
$subject = '[PHP Snippets] From '.$name;
$body = "Name: $name \n\nEmail: $email \n\nComments: $comments";
$headers = 'From: '.$name.' <'.$emailTo.'>' . "\r\n" . 'Reply-To: ' . $email;
wp_mail($emailTo, $subject, $body, $headers);
$emailSent = true;
echo "Done";
}
else {
echo "Spam";
}
}
}
?>

Answer 1

Use double quotes:
$rsp = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=$secret&response=$captcha&remoteip=$ip");
Else the variables won't work. PHP will only search a string for variables and display their values if it's surrounded by double quotes. You can use single quotes, but then you have to seperate the variables and strings like this:
$rsp = file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret='.$secret.'&response='.$captcha.'&remoteip='.$ip);
Performance wise, it's always better to use single quotes so PHP doesn't need to search a full string for variables.