Php verification code

When the php verification code is used as the verification code, I use ajax to submit the user-generated verification code to php for judgment.

Some people say this is wrong. others can bypass js.

What I don't understand is that if he bypasses the js verification code, it will expire, but my form won't be submitted, because my form is written in the success status returned by ajax.

Reply to discussion (solution)

Ajax submits the user-generated verification code to php for judgment. what does "user-generated verification code" mean?

Ajax submits the user-generated verification code to php for judgment. what does "user-generated verification code" mean?

User-entered verification code

I don't understand what you're puzzled about.
If you are questioning people's opinions, you don't have.

I understand. you extracted the verification code from the js end for separate verification.
In this way, there are indeed security issues. verification is required to achieve the effect of restrictions.
Why? he can see the code that you run after successful execution.
The browser has a function to execute js code. if you directly execute the successful code, you will not be able to bypass it...

The verification code cannot be submitted unless the key data is returned after the verification code is submitted.
This verification code is useful, but you have to ensure that the key data is not the same each time. Otherwise, someone else manually enters the verification code and obtains your content.
Similarly, a new verification code is returned, and the submitted interface is used for determination.

The verification code cannot be verified by a separate program. it must be used together with the user name and password. Otherwise, the verification code will be skipped when packets are sent directly without the browser.

Ajax is verified once, and then verified again when post is submitted.