无法使用PHP和cURL连接到reCAPTCHA的服务器

Question

I want to add reCAPTCHA to my website hosted on SourceForge, but it just doesn't work when I try to verify the user's response in the backend.

Here's my code:

<?php
$secret = '****';
$recaptcha_response = $_POST["recaptcha_response"];
$url = 'https://www.google.com/recaptcha/api/siteverify';
$post_data = "secret=".$secret."&response=".$recaptcha_response;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_CAINFO, '****/GeoTrust.cer');
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
$response_json = curl_exec($ch);
if (curl_errno($ch)) {
    var_dump(curl_errno($ch));
}
curl_close($ch);
......
?>

The result is int(7), means "cURL couldn't connect".

Could anybody help me with this problem? Thanks a lot.

Answer 1

neither your secret nor your response is urlencoded, so if they contain any special characters, the server will receive the wrong data, fix that. also, reCaptcha's ability to block spammers will probably be improved if you send the client's ip address too, so, while not required, i suggest you send the ip. and instead of multiple calls to urlencode, you can give an array to a single http_build_query call, which often results in prettier code than multiple urlencode() calls. try this:

$post_data=http_build_query ( array (
        'secret' => '???',
        'response' => $_POST ['g-recaptcha-response'],
        'remoteip' => $_SERVER ['REMOTE_ADDR']
) );

but this doesn't explain why curl_exec fail.. to debug that, add CURLOPT_VERBOSE=1 ... then update your question with the VERBOSE data

also, don't ignore the return value of curl_setopt, if there was a problem setting your options, curl_setopt returns bool(false), which you just ignore.. use something like

function ecurl_setopt ( /*resource*/$ch , int $option , /*mixed*/ $value ){
    $ret=curl_setopt($ch,$option,$value);
    if($ret!==true){
        //option should be obvious by stack trace
        throw new RuntimeException ( 'curl_setopt() failed. curl_errno: ' .  curl_errno ($ch) .'. curl_error: '.curl_error($ch) );
    }
}

for example, if curl_setopt($ch, CURLOPT_CAINFO, '....../GeoTrust.cer'); fails, it returns bool(false) , and your curl_exec fail because it can't validate the signature