How to validate Google reCaptcha / noCaptcha in PHP?

Question

How to send such POST that Google asks and so make my field validated?

Answer 1

You send the POST method with the necessary data to google and receives content in PHP Array as follows:

    $captcha = $_POST['g-recaptcha-response'];
    $response = json_decode(file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=<SUA SITE KEY>&response=" . $captcha . "&remoteip=" . $_SERVER['REMOTE_ADDR']), TRUE);

g-recaptcha-response is the variable $_POST that your reCaptcha will create.

file_get_contents(...) is a function that executes the file and expects the file to give results as return to it. In this case we call a Google validator through the link and give value to it the values needed to operate and it returns us the following in JSON:

{
  "success": true|false,
  "error-codes": [...]   // optional
}

json_decode('...', TRUE) transforms the object JSON in array PHP. If the second value (in the syntax TRUE) for FALSE we will receive a object instead of array.

You can now validate like any other array in PHP:

if ($response['success'] == FALSE) {
        // Maldito spammer!
        return FALSE;
    } else {
        // Nice user
        return TRUE;
    }

---

Good studies! :)

Answer 2

If it doesn’t work with file_get_contents (as happened on my hosting server). There is a library on github, but I implemented with cURL. Was basically like this:

# Os parâmetros podem ficar em um array
$vetParametros = array (
    "secret" => "SUA-CHAVE-SECRETA",
    "response" => $_POST["g-recaptcha-response"],
    "remoteip" => $_SERVER["REMOTE_ADDR"]
);
# Abre a conexão e informa os parâmetros: URL, método POST, parâmetros e retorno numa string
$curlReCaptcha = curl_init();
curl_setopt($curlReCaptcha, CURLOPT_URL,"https://www.google.com/recaptcha/api/siteverify");
curl_setopt($curlReCaptcha, CURLOPT_POST, true);
curl_setopt($curlReCaptcha, CURLOPT_POSTFIELDS, http_build_query($vetParametros));
curl_setopt($curlReCaptcha, CURLOPT_RETURNTRANSFER, true);
# A resposta é um objeto json em uma string, então só decodificar em um array (true no 2º parâmetro)
$vetResposta = json_decode(curl_exec($curlReCaptcha), true);
# Fecha a conexão
curl_close($curlReCaptcha);
# Analisa o resultado (no caso de erro, pode informar os códigos)
if ($vetResposta["success"]) echo "<p>Captcha OK!</p>\n";
else 
{
    echo "$<p>Problemas:</p>\n";
    foreach ($vetResposta["error-codes"] as $strErro) echo "$strTab<p>Erro: $strErro</p>\n";
}

I didn’t see the benefit of using the library, but if you want to see, there’s a related article where I answered both options.