Question

I am trying to add ReCaptcha into a mail form that I created which is intended for sharing content,
but for some reason the captcha is not being validated when I hit “submit”, meaning that even if you enter a wrong text in the captcha, the form will still send the email.
I am using joomla 2.5.8, the recaptcha plugin is enabled (although I don’t think it is being intialized since I added the recaptchalib.php myself and I am including the ref to the publickey and privatekey inside the mail form code).

Any help would be very much appreciated!
Thank you!!
here is the code:

<?php require_once('recaptchalib.php'); ?>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<script language="javascript" type="text/javascript">

              function validateEmail($email)
   {
        var emailReg = /^([\w-\.]+@([\w-]+\.)+[\w-]{2,4})?$/;
        if( !emailReg.test( $email ) )
        {
           return false;
        }
        else
      {
           return true;
        }
   }

   function validateForm()
   {
      var form = document.mailForm;
      if (form.recipient.value == "" || validateEmail(form.recipient.value)==false)
      {
         alert("bad email");
         return false;
      }
      if (form.subject.value == "")
      {
         alert("please enter subject");
         return false;
      }
      if (form.content.value == "")
      {
         alert("please enter massage");
         return false;
      }
      <?php 
      $privatekey = "privatekey";  
      $resp = recaptcha_check_answer($privatekey,$_SERVER["REMOTE_ADDR"],$_POST["recaptcha_challenge_field"],$_POST["recaptcha_response_field"]);   ?>                 
      if (!$resp->is_valid) 
      {    
      alert("try again");
         return false;
       }
      return true;
   }      
</script>
<?php 
   if($this->success=='1')
   {   
      echo JText::_('MAIL_SEND_SUCCESSFULLY');
   }   
   elseif($this->success=='0')
   {
      echo JText::_('MAIL_SEND_FAILED');
   }   
?>
<div id="SendMail">
   <h2>send mail</h2>   
   <form action="index.php" name="mailForm" method="post" onsubmit="return validateForm()">

   <table>
      <tr>
         <td><label><?php echo JText::_('MAIL_SEND_TO'); ?>:</label></td>
         <td><input type="text" name="recipient" size="25" value=""/></td>
      </tr>
      <tr>
         <td><label><?php echo JText::_('MAIL_SUBJECT'); ?>:</label></td>
         <td><input type="text" name="subject" size="25" value=""/></td>
      </tr>
      <tr>
         <td><label><?php echo JText::_('MAIL_MESSAGE'); ?>:</label></td>
         <td>
            <textarea name="content" rows="10" cols="40"></textarea>
            <br/><?php echo JText::_('MAIL_DESC'); ?>
         </td>
            <tr>
            <td><?php $publickey = "public key"; ?></td>
            <td><?php echo recaptcha_get_html($publickey);?></td>
            </tr>
   </table>      
   <p>
      <input type="hidden" name="controller" value="mail" />
      <input type="hidden" name="task" value="sendMail" />   
      <div class="button-mail">
         <input style="width: 50px;height: 25px;" type="submit" name="submit" value="<?php echo JText::_('SEND'); ?>"/>
         <a href="javascript: void window.close()" title="Close Window"><span style="color: #444;
   border: #D5D5D5 1px solid; padding: 4px; width: 50px;height: 25px;"><?php echo JText::_('CLOSE'); ?></span></a>
      </div>
   </p>
   </form>
</div>

Answer 1

You have error in the code. Please look this lne

if (!$resp->is_valid) 
{    
    alert("try again");
    return false;
}

Where $resp->is_valid is the PHP but executed as JS.

1. Correct code would be

   if (!<php (int)$resp->is_valid;?>) 
   {    
       alert("try again");
       return false;
   }
   

   But it will not work anyway because of 2.

2. You cannot check recaptcha code in Javascript validation. It should be checked server side. Or if you want to check with javascript it should be checked with AJAX request to server. That is because you code

   <?php 
   $privatekey = "privatekey";  
   $resp = recaptcha_check_answer($privatekey,$_SERVER["REMOTE_ADDR"],$_POST["recaptcha_challenge_field"],$_POST["recaptcha_response_field"]);   ?>                 
   

   is executed on form load before even user eneter captcha.