google no captcha still shows text - php

Question

I have this code in my form:
<div class="g-recaptcha" data-sitekey="MY_KEY"></div>
And the validation part:
// Re captcha part
if (isset($_POST['g-recaptcha-response'])){
$captcha = $_POST['g-recaptcha-response'];
}
if (!$captcha) {
redirect('login', 'refresh');
}
$response=file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=MY_SECRET_KEY&response=".$captcha."&remoteip=".$_SERVER['REMOTE_ADDR']);
// t($response,1);
if($response."success" == false) {
redirect('login', 'refresh');
}
It sort of works now, this is my result:
When I click the checkbox, I still need to type the text for verification.
I thought that clicking the checkbox was enough?
Am I doing something wrong here?

Answer 1

Here's how I check "No Captcha" response and it always shows me "one click" verification box, even in localhost:
$g_recaptcha_response = filter_input(INPUT_POST, 'g-recaptcha-response');
if (isset($g_recaptcha_response)) {
$google = 'https://www.google.com/recaptcha/api/siteverify?secret='
. ZorAuthConfig::RC_SECRET_KEY
. '&response=' . $g_recaptcha_response;
$google_json = file_get_contents($google);
$google_data = json_decode($google_json);
// Check reCaptcha response.
if (!$google_data->success) {
// Do something if robot.
} else {
// Do something if human.
}
}
I implemented this in small library I wrote recently, so you can check it out if you want more details: https://github.com/zoran-petrovic-87/ZorAuth
http://zoran87.blogspot.com/2014/12/zorauth-10b-complete-flexible-no.html

Answer 2

The reCaptcha will verify at first if you are a bot or not by analyzing your mouse movements (and other stuff).
In case the test failed, it will popup a box where you need to write the 2 words shown in the image.
This is all fine and normal, but this is only a client side validation, if you need to make sure that validation was truly successful and not hacked in some way, or whatever... Then you submit the form which will contain the g-recaptcha-response like the way you did, then you will receive the final confirmation from Google in that JSON string.