How to create a security code?

[c4n]

A lot of sites are using security codes to prevent automated signup (for instance paypal.com when you signup for a new account has one at the bottom). I'm sure you've seen it, it's an image with some characters and you must type correct characters in the input field in order to submit the form successfully.

My question is how can be this image with characthers generated using Perl and how can I pass the code to the script (so i can compare it to the one the user typed in)?

Thanks in advance!

 

[philote]

If you could probably use ImageMagick to do this (

http://www.imagemagick.org/).

If you go this route and are using perl, check out PerlMagick (

http://search.cpan.org/~jcristy/PerlMagick-5.57/).

Kevin
A+, Network+, MCP

 

[siberian]

Using this with CGI::Session should solve your problem.

On page request create the image and display it. Note in the users session what number you asked them to type in to verify.

When the form is submitted you compare the number they entered with the number you stored in their session. if they match its good!

 

[philote]

siberian's post is definitely the way to go to verify the code. But to generate the image with the code on it, you'll have to have a program that can do that, like ImageMagick.

Another way to create the images may be to create beforehand an individual image for each possible character in the code, like 0 through 9 and A through Z. Then for each digit in the randomly created code, display the corresponding image.

This is probably not as secure as a single-image method but would be easier than figuring out how to generate an image on the fly.

Also, I just did a Google search on "image verification" and found these for php:

http://www.cxliv.org/jayseae/2003/10/15/verification_image_with_php.html

http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=739&lngWId=8

Kevin
A+, Network+, MCP

 

[c4n]

Thanks for all the help, I'll go with the image being created from smaller "character" images and the code stored in the session ID.

Regards