title: Home made captcha , is it safe?
body: <p>I've been gathering information about how to protect from <em>brut force attack</em> on the logging page or from the haressment of <em>multiple account creation.</em></p>
  
  <p>I came to the conclusion (thanks to you guys of Stackoverflow)  that the best way would be to use captchas.</p>
  
  <p>But uneasy to read captchas or accented characters may deter users from using a website.</p>
  
  <p>So, I found out an easy to use little script I adapted to my site. It's a simple math captcha proposing to sum up 2 figures from <em>zero to ten</em>. It displays the words <strong>'one' 'two' 'three'</strong> ... not the figures.  </p>
  
  <p>My questions are :</p>
  
  <p>1) Does this little captcha provide sufficient security in itself ?</p>
  
  <p>2) Is the way I integrated it safe ? ( any way to bypass it ?)</p>
  
  <p><em>To avoid pasting 800 lines of code I've made a summary, I hope it is clear.</em></p>
  
  <p><strong>captcha script :</strong></p>
  
  <pre><code>$n1  = mt_rand(0,10);  
  $n2  = mt_rand(0,10);  
  $fig = array('zero','one','two','three','four','five','six','seven','eight','nine','ten');  
  $result = $n1 + $n2;
  $sentence = $fig[$n1] .' plus '.$fig[$n2];  
  $_SESSION['captcha'] = $result;  
  $captcha_label = "&lt;label for='captcha' &gt;How much does ".$sentence."make?&lt;/label&gt;";               
  echo $captcha_label."&lt;/label&gt;&lt;input  type='text' name='captcha'  value=''/&gt;&lt;br /&gt;";                                 
  echo "&lt;input type='submit' name='create' value='create account'&gt;"; 
  </code></pre>
  
  <p><strong>PAGES:</strong></p>
  
  <ul>
  <li><strong>form.php:</strong></li>
  </ul>
  
  <p>all <em>'create account'</em> input fields + captcha</p>
  
  <p>=> test</p>
  
  <ul>
  <li><p><strong>test.php:</strong></p>
  
  <p><code>if($_POST['captcha'] != $_SESSION['captcha']){<br>
      $_SESSION['captcha_control'] = "false";</code>
      }  </p></li>
  </ul>
  
  <p>Then all <em>'create account'</em> $_POSTS are injection tested</p>
  
  <p>If any of them or the captcha returns "false" , the script deflects to => problem.php</p>
  
  <ul>
  <li><strong>problem.php:</strong></li>
  </ul>
  
  <p>Echoes the initial form with all "wrong fields" highlighted 
  and a new captcha is displayed, was it right or was it wrong.<br>
  validation => back to <strong>test.php</strong></p>
  
  <p>Thanks a lot.</p>