PHP Verification Code

When I do the verification code, I use AJAX to submit the user-generated verification code to PHP for judgment.

Some people say this is wrong, others can bypass JS

I do not understand that he bypassed the JS verification code will expire, but I will not submit the form, because my form is written in the Ajax returned to the successful state of the

Reply to discussion (solution)

What does Ajax mean when a user-generated verification code is submitted to PHP for judgment on this side of the "User generated verification code"?

What does Ajax mean when a user-generated verification code is submitted to PHP for judgment on this side of the "User generated verification code"?

User-filled verification code

I don't know what you're puzzled about.
If it's a question of what people say, it doesn't have to be.

I understand, you are the verification code on the JS side to extract the individual verification
This does have security issues that you can verify together to achieve the effect of throttling
Why, he can see the code you executed after your success.
Browser has a function to execute the JS code, directly after the success of the code to carry out the implementation of a bit not to bypass it ...

Unless you have returned the key data after the verification code has been submitted, he cannot successfully submit it without this data
This verification code is still useful, but you have to ensure that every time the key data is not the same, otherwise people manually input the content to get you
Similar to return a new verification code, and then submit the interface to make a decision.

Verification code can not be verified with a separate program, must be with the user name password, otherwise people do not use the browser directly send the packet to skip

Ajax is validated once and then verified once when the post is submitted.

