Captcha integration question (with form)

[topsites]

I have a Captcha script (random image password verifier) I am trying to incorporate into another script, but it's just not working.

[mod edit: Wants to combine captcha and link check forms]

So that when someone enters the link to check, they then also enter the code, and click submit...

[edited by: ergophobe at 5:09 pm (utc) on Jan. 4, 2006]
[edit reason] Personal and commercial URLs snipped [/edit]

[ergophobe]

It should be fairly simple.

1. Combine the captcha enter field and the link check field in one form with one submit button.
2. Do your captcha check
3. if it succeeds, pass off to the link checker script.

[topsites]

And just how would I do that?

[topsites]

Here is my problem in a nutshell:

<?
session_start();

if(!empty($_SESSION['captcha_word']) &&!empty($_POST['word']))
{
if($_POST['word']==$_SESSION['captcha_word'])
{
// process form and then:
header("Location=somewhere.php");

<<<< rest of code >>>>

This basic implementation works, but then what's to stop someone from simply typing somewhere.php directly in their browser for future sessions?
Btw, the linkchecker is NOT session-enabled, apparently the mere addition of 'session_start();' at the top of the linkchecker script crashes the whole thing... It doesn't work at this point, but also:
I have thought of passing along a unique password but it does not appear possible to pass along variable information via the header:Location command unless I make said information visible in the browser's url-line, thus defeating the purpose.

........
The script is relatively short, and I did try to squeeeeeeze the relevant parts around the linkchecker's code as follows:

define all variables and functions.
captcha code blablabla
captcha IF
Condition YES

<<<<< all the relevant linkchecker code here>>>>

Condition NO
Stop.

... but the session_start command ruins everything, with or without it, nothing works.

While it runs unprotected and it is recursive, the script runs wide open ... Hence why I'd like to fix it, slow things down a bit LOL.

[coopster]

This basic implementation works, but then what's to stop someone from simply typing somewhere.php directly in their browser for future sessions?

Nothing. Unless you have an edit in the very beginning of that script to confirm that the $_POST variable where they keyed the Captcha word in has been set by you. Does that make sense? So, when they key in the Captcha word in the form, store not only the Captcha word that you generated, but also the one that they entered or maybe even a simple boolean (true/false) variable that lets you know that your user has already been to the "Captcha" page and keyed in the value correctly.