Passing value from one php page to another using TPL files - php

Question

So this is the situation, which is related to a foolish captcha system I have set up.
register.php, register.tpl, writer.php
register.tpl creates the form
register.php processes the form, but also initially creates a random number that the form, in register.tpl picks up as a variable i.e. {vcode}.
That random number is used in the following context:
<img src="/system/writer.php?R=0&T={vcode}" />
<input type="hidden" name="syscode" value="{vcode}" />
<strong>Enter Code:</strong>
<input name="code" type="text" id="code" />
writer.php captures the value of vcode and creates an image.
Problem:
a. vcode can be read by bots and therefore this captcha is useless.
b. register.php asks if syscode != code but again syscode is a useless field cause bots can read it.
c. I've taken the process in register.php that generates a random number and placed it in writer.php but I can't get the value of the random variable that's created into register.php to make the comparison, as in:
In writer.php I have $randno = and(1,999999); and that value is displayed as an image - I know you all know that, but now I need register.php to read $randno or get the value so it can make the comparison as in:
if $code = $randno { stuff }
The basic problem is creating a trustworthy captcha using TPL files...it's not that easy.
Every, I thank you for your assistance and for trying to help me.

Answer 1

Simple solution:
use session store to store the code or use a database:
register generates a code and store this code in session/database.
if you want use the database be sure to use also e.g. a random token to avoid bruteforce to other codes.
If not, an attacker can void all captchas and your users can't register.
you can omit the token, database, the hidden fields and the parameter for writer.php if you would use sessions.
but if you dont want use sessions:
register.php:
if(form_is_submitted()) {
/*check captcha */
$captcha_id = (int) $_POST['captcha_id'];
//SELECT code, token FROM captchas WHERE id = $captcha_id
if($token != $_POST['token'] )
die("Error");
// DELETE FROM captchas where id = ...
if( $code != $_POST['code'])
// -> error
}
/* Display form */
$code = generate_code();
$token = generate_token();
mysql_query("INSERT INTO captcha (code, token) VALUES ($code, $token)");
$tpl['chaptcha_id'] = mysql_insert_id()
register.tpl
<img src="/system/writer.php?R=0&T={captcha_id}" />
<input type="hidden" name="token" value="{token}" />
<input type="hidden" name="captcha_id" value="{captcha_id}" />
<strong>Enter Code:</strong>
<input name="code" type="text" id="code" />