机器人如何规避我的验证码？

Question

Here's my script to check for filled in fields:

foreach($_POST as $key => $value){
    //required fields
    if(in_array($key, $required_fields) && empty($value) && $all_required_filled){
        $error_message .= "<li>Not all required fields were filled out</li>"; 
        $valid = false;
        $all_required_filled = false;
    }
    //valid email address
    if($key == 'email'){
        if (!filter_var($value, FILTER_VALIDATE_EMAIL)) {
            $error_message .= "<li>Invalid email format</li>";
            $valid = false; 
        }
    }
    //captcha is valid
    if($key == "captcha"){
        if((int)$value !== (int)$_SESSION['veriword']){
            $error_message .= "<li>The captcha was incorrect</li>";
            $valid = false;
        }
        else{
            $message .= "User entered {$value}. Correct answer was {$_SESSION['veriword']}";
        }
        continue;
    } 
}

Basically, if the captcha form field matches the session variable that the captcha plugin sets, the script prints a line in the the email that lists what the user entered, and the correct value.

When I fill out the captcha incorrectly, I can't send the form through, and get stuck on the page with an error message. Somehow, though, a spam bot is sending out the form successfully, without the line listing the form field and captcha values. So it's completely getting around the "if" statement, somehow? I'm not sure what's going on...

Answer 1

Instead of looping over $_POST , check the the required inputs explicitly:

if (isset($_POST['captcha'])) {
    if (intval($_POST['captcha']) !== $_SESSION['veriword']) {
        $error_message .= "<li>The captcha was incorrect</li>";
        $valid = false;
    }
} else {
    $error_message .= "<li>The captcha was not submitted</li>";
    $valid = false;
}