Sicherheitsbilder (Captchas) gegen SPAM  -  Der komplette Code

<?php
 
/**
* Aufbauen einer mysql Verbindung
* @author Christian Blechert
* @since Juni 2008
*/
 
class mysqlClass {
 
   private $connection;
   private $database;
   private $enc;
   static $counter = 0;
 
   /**
   * @param host Hostname des mysql Servers
   * @param user Benutzername
   * @param password Passwort zum Benutzer
   * @param database Zu benutzende Datenbank
   * @param enc Zeichenkodierung
   */
   function __construct($host, $user, $password, $database, $enc="utf8") {
      $this->connection = 0;
      $this->database = 0;
      $this->enc = $enc;
      $this->mysqlConnect($host, $user, $password, $database, $enc);
   }
 
   /**
   * Verbindung bei Vernichten der Klasse trennen
   */
   function __destruct() {
      $this->mysqlDisconnect();
   }
 
   /**
   * Verbindung herstellen
   * @param host Hostname des mysql Servers
   * @param user Benutzername
   * @param password Passwort zum Benutzer
   * @param database Zu benutzende Datenbank
   * @param enc Zeichenkodierung
   */
   function mysqlConnect($host, $user, $password, $database, $enc) {
      if($this->connection!=0) $this->mysqlDisconnect();
      if($this->connection = @mysql_connect($host, $user, $password)) {
         if($this->database = @mysql_select_db($database, $this->connection)) {
            @mysql_query("SET NAMES '".$enc."'");
         }
      }
      if(mysql_errno($this->connection)) die(mysql_error($this->connection));
   }
 
   /**
   * Verbindung trennen
   */
   function mysqlDisconnect() {
      @mysql_close($this->connection);
      if(!mysql_errno()) {
         $this->connection=0;
         $this->database=0;
      } else {
           die(mysql_errno().": ".mysql_error());
      }
   }
 
   /**
   * mySQL Statement absetzen
   * @param query MySQL Statement
   * @return ResultSet des Statements
   */
   function mysqlQuery($query, $die=true) {
      $result = mysql_query($query);
      if(mysql_errno($this->connection)) {
         if($die) die(mysql_errno($this->connection).": ".mysql_error($this->connection));
      } else {
         mysqlClass::$counter = mysqlClass::$counter+1;
      }
      return $result;
   }
   
   /**
   * Liefert die Anzahl der betroffenen Zeilen Zurueck
   */
   function mysqlAffectedRows() {
      return @mysql_affected_rows($this->connection);
   }
 
   /**
   * Liefert das result eines Statements in einem 2 Dimensionalen Array
   * @param query MySQL Statement
   * @return Array[][] result
   */
   function mysqlArray($query) {
      $i=0;
      $result = $this->mysqlQuery($query);
      while($row=mysql_fetch_array($result)) {
         for($j=0; $j<sizeof($row); $j++) {
            $array[$i][@mysql_field_name($result, $j)] = $row[$j];
         }
         $i++;
      }
      $return[0] = mysql_num_rows($result);
      $return[1] = mysql_num_fields($result);
      $return[2] = $array;
      return $return;
   }
 
   /**
   * Verkuerzte Version von mysql_real_escape_string()
   * @param query Wert zum Escapen
   * @return der Escaped String
   */
   function sqlij($string) {
      return mysql_real_escape_string($string);
   }
 
   /**
   * Liefert den aktuellen Stand des Query Counter
   * @return int Wert
   */
   function getNumQuerys() {
      return mysqlClass::$counter;
   }
 
   /**
   * Liefert die Zeichenkodierung
   * @return string
   */
   function getEnc() {
      return $this->enc;
   }
   
   /**
    * Gibt falls vorhanden den MySQL Error zuruech
    * return String
    */
   function getSQLError() {
         return mysql_error($this->connection);
   }
   
   /**
    * Gibt falls vorhanden den Fehler Codes des Errors zurueck
    * return int
    */
   function getSQLErrno() {
         return mysql_errno($this->connection);
   }
   
   /**
    * Liefert die ID des letzten insert Befehls
    * @param int
    */
   function getInsertID() {
         return mysql_insert_id($this->connection);
   }
 
}
 
?><?php
 
/**
* Klasse zur Nutzung von Captchas
* @author Christian Blechert
* @since Septemper 2008
*
*/
 
class captcha {
   
   private $fontsize;
   private $fontfile;
   private $imagefile;
   private $align;
   private $sql;
   
   function __construct($host, $user, $password, $database, $align="right") {
       $this->fontsize = 11;
       $this->fontfile = "VeraMono.ttf";
       $this->imagefile = "captcha.png";
       $this->align = $align;
       $this->sql = new mysqlClass($host, $user, $password, $database);
   } // $this->sql->
   
   function getToken() {
      $token = md5(time().mt_rand(0, 9999999));
      $this->sql->mysqlQuery("insert into captcha_sessions set token='".$this->sql->sqlij($token)."', ip='".$_SERVER['REMOTE_ADDR']."', dtime=NOW(), value='".md5(time())."'");
      return $token;
   }
   
   function deleteTokens() {
      $this->sql->mysqlQuery("delete from captcha_sessions where dtime<FROM_UNIXTIME(".(time()-132000).")");
   }
   
   function checkValue($value, $token) {
      $this->sql->mysqlQuery("delete from captcha_sessions where token='".$this->sql->sqlij($token)."' and value='".$this->sql->sqlij($value)."' and ip='".$_SERVER['REMOTE_ADDR']."'");
      if($this->sql->mysqlAffectedRows()<1) {
         return false;
      } else {
         return true;
      }
   }
   
   function getCaptcha() {
      $this->deleteTokens();
      $token = $this->getToken();
      echo "<img id='captcha' class='captcha' src='captcha.php?token=".$token."' alt='Captcha'>";
      echo "<input type='hidden' name='captcha_token' value='".$token."'>";
   }
   
   function getPicture($token) {
 
      $math[0] = "+"; $math[1] = "-"; $math[2] = "*"; $math[3] = ":";
      $math = $math[mt_rand(0, sizeof($math)-1)];
      switch($math) {
         case "+": $wert1 = mt_rand(1, 20); $wert2 = mt_rand(1, 20);
                   $value = $wert1+$wert2; break;
         case "-": $wert1 = mt_rand(10, 99); $wert2 = mt_rand(0, 9);
                   $value = $wert1-$wert2; break;
         case "*": $wert1 = mt_rand(1, 5); $wert2 = mt_rand(1, 5);
                   $value = $wert1*$wert2; break;
         case ":": $wert2 = mt_rand(2, 9); $wert1 = mt_rand(2, 9);
                   $wert1 = $wert1*$wert2;
                   $value = $wert1/$wert2; break;
      }
      
      $result = $this->sql->mysqlQuery("update captcha_sessions set value='".$this->sql->sqlij($value)."' where token='".$this->sql->sqlij($token)."' and ip='".$_SERVER['REMOTE_ADDR']."'");
      if($this->sql->mysqlAffectedRows()<1) die("Unknown Token!");
 
      if($this->align=="left") {
         $text = "= ".$wert1." ".$math." ".$wert2;
      } else {
         $text = $wert1." ".$math." ".$wert2." =";
      }
 
      header('Content-type: image/png');
      $img = ImageCreateFromPNG($this->imagefile);
      $angle = rand(0,5);
      $t_x = mt_rand(0, 16);
      for($i=0; $i<strlen($text); $i++) {
         $rgb[0] = mt_rand(0, 100);
         $rgb[1] = mt_rand(0, 255);
         $rgb[2] = mt_rand(0, 100);
 
         $t_y = mt_rand(13, 15);
         $color = ImageColorAllocate($img, $rgb[mt_rand(0, sizeof($rgb)-1)], $rgb[mt_rand(0, sizeof($rgb)-1)], $rgb[mt_rand(0, sizeof($rgb)-1)]); //Farbe
         imagettftext($img, $this->fontsize, $angle, $t_x, $t_y, $color, $this->fontfile, substr($text, $i, 1));
         if(substr($text, $i+1, 1)==" ") $t_x+=2; else $t_x+=10;
      }
      imagepng($img);
      imagedestroy($img);
   }
   
}
 
?>

<?php
 
   include_once('captcha.class.php');
   $cc = new captcha("localhost", "root", "toor", "db");
   $cc->getPicture($_GET['token']);
 
?>

<?php
 
   include_once('captcha.class.php');
   $cc = new captcha("localhost", "root", "toor", "db");
   $token = $cc->getToken();
 
   if(isset($_POST['senden'])) {
      $cc->deleteTokens();
      if($cc->checkValue($_POST['captcha'], $_POST['captcha_token'])) {
         echo "<h1>Eingabe richtig!</h1>";
      } else {
         echo "<h1>Eingabe falsch!</h1>";
      }
   }
 
echo "<form method='POST' action=''>";
   $cc->getCaptcha();
   echo "<br>Eingabe: <input type='text' name='captcha'><br><br>";
   echo "<input type='submit' name='senden' value='Check'>";
echo "</form>";
 
?>

CREATE TABLE IF NOT EXISTS `captcha_sessions` (
  `token` varchar(32) collate latin1_general_ci NOT NULL,
  `ip` varchar(15) collate latin1_general_ci NOT NULL,
  `dtime` datetime NOT NULL,
  `value` int(5) NOT NULL,
  PRIMARY KEY  (`token`)
);