Just added two thingies every single dynamic website out there has, but Tinker Tanks still hadn’t: captchas in submitted forms, and some caching. As usual, what I ended up with is rough, more a playful exercise and starting point than actual production-worthy code.
A colleague of mine suggested to use memcached to do the heavy reading/writing needed to make a game advance. However, as memcached is key-value based and my round mechanism depends rather heavily on id lookups and things like that, I am not entirely sure yet how I would make that work. Also, I don’t own the server so it’s easier to play around with the php code then with the server stuff.
So, while reading up on caching anyway, I implemented a super basic PHP caching mechanism, more to get a feeling for it then for actual practical purpose (I am pretty sure it actually slows me down now). It is time based, with a ‘time to live’.
When fetching data from the database I can now opt to do a ‘cached call’, and pass on a timeout parameter for how long a cache remains valid: e.g. calling $db->getResults(true, 3600) would cache results with a time-to-live of an hour.
The cache itself is a bunch of serialize()d .txt files. The lookup key for individual cache results is simply the filename which has a hash of the exact SQL query in it.
So, say we fetch data with a function that queries for ‘SELECT * FROM users WHERE userid=35′ the cache-enabled way, here’s what happens:
- Look trough the caches and see if we find a file which has a matching filename and (if it has non-infinit TTL) is modified recently enough.
- If we find a match, unserialize() it and return that as query result.
- If we find no match, do a ‘normal’ query in the database and (over)write the text file.
And that’s it. Many users will also typically mean many cache files, but we can live with that.

The forum is a tad more polished (but still ugly)
Poking around with the forum a bit (I admit it, I felt too tired to plunge in the descent-bot bee hive again) also led me to create a captcha. I never read about them or downloaded one or whatever, but giving how they are I guess my mechanism is the ‘usual one’.
Here’s a the mechanism in its barest form – it’s three steps:
- In the php controlling the page that has the form to be submitted, generate some random captcha string that the user will have to type. Put this string in the $_SESSION.
function generateCaptcha()
{
$captcha = (string) rand (0,999);
$_SESSION['latestCaptcha'] = $captcha; //store for checking on next submit
}
- In the page itself, insert a dynamically generated image (using GD) with this string in it (in my case the src of an IMG points directly to a captcha.php file that gets the needed string from the session and sticks it on a fixed image). Something like this:
<?php
$im = imagecreatefrompng('http://mydomain.com/img/background_g.png');
$color = imagecolorallocate($im, 255, 255, 255);
session_start();
$captcha = $_SESSION['latestCaptcha'];
$x = 2;
$y = 4;
imagestring($im, 4, $x, $y, $captcha, $color);
header('Content-type: image/png');
imagepng($im);
imagedestroy($im);
?>
- Finally, among the checks that happen on a submitted form, add one that checks if the submitted captcha matches the latest generated one.
function checkCaptcha($submitted)
{
$isValid = ($submitted == $_SESSION['latestCaptcha']);
unset($_SESSION['latestCaptcha']); //so there's no confusion with the next captcha check
return $isValid;
}
Now, even with the function parameter checks I left out this is obviously not a very good captcha: my string is just a number, extracting those non-disorted characters out of my decoy-less background violates the basic captcha characteristics, so the captcha string could easily be extracted by software. But it was still interesting putting it in there, and surely it will do while my site is still unknown – that’s becoming a recurring theme
Oh, I am also tinkering with another one of those everybody-has-it things: an automated welcome mail that has markup and makes it trough spam filters (hint: not there yet).
That’s it for today folks!