Page 1 of 1
image verification and GD
Posted: Fri Dec 09, 2005 8:14 am
by scriptmaster
hi guys
I've written an image verification script which works great but I'm afraid may not work on other servers (as it does on mine).
this is what I used:
http://www.devpapers.com/article/149
I was wondering if there is a way to create an image verification code without using GD library? do most servers have the above supported?
thanks
Posted: Fri Dec 09, 2005 8:36 am
by phpdevuk
doesn't like it much on my test server, but that could be something to do with the setup
Posted: Fri Dec 09, 2005 9:14 am
by scriptmaster
phpdevuk wrote:doesn't like it much on my test server, but that could be something to do with the setup
this is just what i'm talking about. what are the error messages you get on your test server?
i'm trying to find something that would work for everybody
Posted: Fri Dec 09, 2005 9:30 am
by AGISB
There is a captch script in the code snipplet section. Maybe you get a start of that.
Posted: Fri Dec 09, 2005 10:02 am
by scriptmaster
AGISB wrote:There is a captch script in the code snipplet section. Maybe you get a start of that.
you mean this:
viewtopic.php?t=29578 ?
GD is required there too.
Posted: Fri Dec 09, 2005 11:12 am
by onion2k
CAPTCHA images should be distorted in some way in my opinion. Both the one in that article and the one in the Snippets folder are too simple to defeat anything but the most basic automated attack.
Posted: Fri Dec 09, 2005 11:44 am
by scriptmaster
onion2k wrote:CAPTCHA images should be distorted in some way in my opinion. Both the one in that article and the one in the Snippets folder are too simple to defeat anything but the most basic automated attack.
my good men, we are getting off topic.
I really don't need a script with some muscle, the question is: is the GD usage in the article I posted work on most servers? do most servers with the most common PHP versions intalled support GD?
Re: image verification and GD
Posted: Fri Dec 09, 2005 12:27 pm
by Roja
scriptmaster wrote:I've written an image verification script which works great
As other posters have brought up, it doesn't solve the problem you are trying to solve - so no, it doesn't "work great". Thats not offtopic - you brought it up.
Its a very serious issue. Imagine someone saying "This solid steel screendoor with lock I put on my
submarine works GREAT at keeping people out!". You wouldn't gloss over that point!
You want to prevent bots - automated visitors. Captchas *do not* do so reliably without a considerable amount of variation, distortion and more. Or put another way, you have to make the captcha so difficult that even humans have problems with it.
Thats why so many people have issues with Captcha's. But thats not your only question, and I aim to please.
scriptmaster wrote:but I'm afraid may not work on other servers (as it does on mine).
do most servers have the above supported?
The answer today, is no. The majority of 'webhosting' companies do not offer GD by default. The better companies will install it if a paying customer requests it. Many free companies will even do so if enough customers want it. But by default, no, the majority don't have GD.
scriptmaster wrote:I was wondering if there is a way to create an image verification code without using GD library?
Yes. You can store a variety of pre-generated images, and mix and match those images before handing them to the user. However, much like GD-based captchas, it will be even more trivial for a bot to defeat.
My honest suggestion is that CAPTCHA is broken - it doesnt solve the problem, and it causes problems for real users. Stop trying to fix the symptom, and work on the problem. If automated (worthless) users are visiting the site, why do they keep visiting?
Re: image verification and GD
Posted: Fri Dec 09, 2005 12:56 pm
by scriptmaster
Roja wrote:As other posters have brought up, it doesn't solve the problem you are trying to solve - so no, it doesn't "work great". Thats not offtopic - you brought it up.
well, until today I only used it on my site and it kept the automated out - that's what I meant by saying it works great - it works great for me in achieving that goal.

.
Roja wrote:
The answer today, is no. The majority of 'webhosting' companies do not offer GD by default. The better companies will install it if a paying customer requests it. Many free companies will even do so if enough customers want it. But by default, no, the majority don't have GD.
that sucks. thanks for that info.
Roja wrote:If automated (worthless) users are visiting the site, why do they keep visiting?
good point.
the automated users are real users that are too lazy to fill a form every now and then, so they use a bot that does the work for them - so they think, every now and than I update the form.
Roja wrote:I was wondering if there is a way to create an image verification code without using GD library?
Yes. You can store a variety of pre-generated images, and mix and match those images before handing them to the user. However, much like GD-based captchas, it will be even more trivial for a bot to defeat.
I actually tried that, not with PHP but with Perl and when I moved to PHP I tried the GD thing.
at the time it worked too.
I don't want them to stop visiting, I just want them to really visit and fill the form manual.
so here is where i'm stuck.....I need a better method than one using GD to make sure the form is filled by a human, and I need it to work on every server or at least on most servers.
Re: image verification and GD
Posted: Fri Dec 09, 2005 2:55 pm
by onion2k
I don't understand the problem. You have a website, right, in which you want to stop the visitors filling out a form automatically. This raises two questions in my mind:
1. It's only one website .. why do you give a damn if the script won't work on other servers? So long as it works on yours then there's no problem.
2. What is the CAPTCHA actually going to stop? The users will still fill the form in automatically, they'll just fill in the CAPTCHA bit by hand before submitting the form. You'll only slow them down a fraction, not stop them from filling in the form.
Roja: I'm not sure you're right about web hosting companies not offering GD .. all the ones I've used have. Although not necessarily a particularly up-to-date version..
Re: image verification and GD
Posted: Fri Dec 09, 2005 3:01 pm
by scriptmaster
onion2k wrote:I don't understand the problem. You have a website, right, in which you want to stop the visitors filling out a form automatically. This raises two questions in my mind:
1. It's only one website .. why do you give a damn if the script won't work on other servers? So long as it works on yours then there's no problem.
2. What is the CAPTCHA actually going to stop? The users will still fill the form in automatically, they'll just fill in the CAPTCHA bit by hand before submitting the form. You'll only slow them down a fraction, not stop them from filling in the form.
Roja: I'm not sure you're right about web hosting companies not offering GD .. all the ones I've used have. Although not necessarily a particularly up-to-date version..
1. it's not only 1 web site.
the form will be on different websites on different servers.
if you don't understand that - leave it at that.
2. I have no idea how CAPTCHA got into this, I don't know what CAPTCHA.
i'm talking about an image verification as Yahoo! or eBay use.
let's try to make it simple.
i'm trying to figure out a way to make sure the form is filled by a human.
if GD was enabled by default - that would be a solution, as I understand it is not, the above is still a problem.
Re: image verification and GD
Posted: Fri Dec 09, 2005 3:59 pm
by onion2k
scriptmaster wrote:1. it's not only 1 web site.
the form will be on different websites on different servers.
if you don't understand that - leave it at that.
2. I have no idea how CAPTCHA got into this, I don't know what CAPTCHA.
i'm talking about an image verification as Yahoo! or eBay use.
let's try to make it simple.
i'm trying to figure out a way to make sure the form is filled by a human.
if GD was enabled by default - that would be a solution, as I understand it is not, the above is still a problem.
1. Fair enough .. You've not been particularly verbose about what you're attempting to do here, I inferred that you were looking for a better way to keep automated bots out of your site.
2. CAPTCHA is the technical term (buzzword.. jargon..

) for the sort of verification image you're talking about.
The solutions available to you if you don't feel GD is ubiquitous enough are limited. The only way I've encountered before that isn't based on an image is to ask the user a very simple question like "What is the capital of France?", or "What is 16 divided by 2?". It's easy to maintain a few hundred different questions that won't stump the user for too long, but will fox an automated system. The problems though are that the automated system will still get in by brute force if it knows the answer to one question .. it just has to try hundreds of times .. and if the user is particularly determined then it would be possible to write an automated system that Googled for the answer (especially for maths questions). Furthermore, if your users are really stupid, or not English, then they might not get in either.
Re: image verification and GD
Posted: Fri Dec 09, 2005 5:00 pm
by Roja
onion2k wrote:Roja: I'm not sure you're right about web hosting companies not offering GD .. all the ones I've used have. Although not necessarily a particularly up-to-date version..
I should have been more specific. We did some polling of BNT admins, and the vast majority of the servers they hosted on did not have gd support.
I would 100% agree that many of the admins running the game choose shall we say "affordable" hosting, which may skew the trend substantially.
Regardless, its a fairly large sample, and if that many "affordable" hosts don't, I think its probably a reasonable statement that many (in general) don't.
Either way, it depends on which servers.
Posted: Fri Dec 09, 2005 5:11 pm
by bokehman