1. On the registration form page, you take note of the captcha code and fill the form with errors (i.e.: unmatched passwords).
  2. Reload the page , you now have a new captcha image.
  3. Fill the form correctly (i.e.: matching passwords) and enter the old captcha code you got in step 1
  4. submit the form

The form submits, while it should not. The security guys don't like that and I need a way to fix this.

Any ideas ?

Side note : I'm using freemember extension and reCaptcha extension does not seem to play nicely with free member. (the problem occurs even on default EE install)

  • I have same issue without any extensions and using channel:form. In my case the captcha field does not validating at all. You can submit the form with blank value for captcha.
    – Vladyn
    Jun 28, 2016 at 7:36
  • Just posted what I did, it's a hack, but had no other solution.
    – laurent
    Jun 28, 2016 at 10:59

1 Answer 1


What I've done is delete all existing captchas for current IP before creating new one. Drawbacks are minors, except it's a hack...

I post here as it might help others.

Around line 1530 in expressionengine/libraries/Functions.php

add following line

ee()->db->query("DELETE FROM exp_captcha WHERE ip_address = '".ee()->input->ip_address()."' OR date < UNIX_TIMESTAMP()-1200");


ee()->db->query("INSERT INTO exp_captcha (date, ip_address, word) VALUES (UNIX_TIMESTAMP(), '".ee()->input->ip_address()."', '".ee()->db->escape_str($word)."')");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.