PHP: Passing a class instance to another page?

I'm trying to implement a captcha system, and I found a nice and very simple class trough google that does what I want.

it's something like:

$captcha = new Captcha();
$prefix = mt_rand();
$image = $captcha->generate($prefix);

then I开发者_如何学Python add the image in the form:

<img src="<?php echo $image; ?>" />
<input name="captcha" type="text" value="Type the security code from above" />

it works fine so far, but I don't know how to check if the submitted code matches the captcha. In the documentation, it says I have to do it with:

$correct = $captcha_instance->check($prefix, $_POST['captcha']);

but the problem is that after the form is submitted $captcha and $prefix are gone...

How do I pass these variables after the form is submitted to the next page?

@mario: you were right :D it's only the $prefix I needed to pass as a hidden input field :)

That's a very bad idea - in your form tag, if say you have hidden field captcha_answer and you're passing the value of that to $captchaInstance->check(), then you defeat the purpose of a captcha. Captcha's are to sort out robots from humans, but its so simple to read a value by downloading the source in the captcha solving bot and just getting the value="{answer}" out of the source.

Instead, you should use this:

<?php
session_start();
$_SESSION['answer'] = $prefix;
?>

Then in your checker you do this:

<?php
session_start();
$prefix = $_SESSION['answer'];
$passed = $captcha->check($prefix);
?>

In fact, I think this class would be better as only having static methods, but that's my opinion. Anyway, this way means that all the data is only stored server-side so they can't just view source for captcha answer.

You might want to set it in the session and then when it's posted, you need to check with the value in the session

Hope this helps

You want to marshall that instance and save it in a session, since HTTP is stateless. You can then demarshall it on the second page.

However:

Most PHP captcha system I've seen do not need this functionality, rather the check function should work independently and usually compares the data from a stored session and a POST variable.

What is the handler mapping needed in IIS 7.x to produce CAPTCHA images? The only one that works seems to be the wildcard, which is ridiculous from a security point of view. In tightening the security of ColdFusion according to the lock-down guide at http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_ lockdownguide_wp_ue.pdf, they recommend to remove this wildcard mapping, but that seems to break CAPTCHA.