While working on a new site that needed a registration system, I started seriously looking at CAPTCHA for the first time. For the uninitiated, CAPTCHA stands for Completely Automated Program for Telling Computers and Humans Apart. The premise of this is simple, humans can read obfuscated text whereas computer programs cannot.

You've probably seen these when registering for various web accounts. Essentially you have a dictionary file and a background file. You randomly select a word from the dictionary file and create an obfuscated image from it, read the background image and obfuscate it, then mash the two together. You then load the image's word into a session variable and pass it along with your form structure.

I've been experimenting with several ways of doing this. I played with Ryan Emerle's cfx_captcha tag, but ran into some problems with flushing the image after it had been used.

Next came OpenXCF from SourceForge. They have a CFX tag nammed ImageString that allows you to place a string on top of an image.

Also, Joe Rineheart create the CF_CreateImage (based on the Alagad Image Component) that can be used to the same end.

There's also a down-side to all of this...accessibility. If you need to keep bots out, be aware that you're significantly reducing accessibility for those with vision impairments. So the question becomes, how do you keep bots aware, without also keeping real people from your site? Here are a couple of potential solutions:

1. Logic Puzzles - a simple word puzzle is a greate way to keep out computers. However, persons with cognative disorders may still have trouble. Plus, the shear vastness of questions needed to keep a program from collecting all the puzzles is prohibitive.
2. Sound Output - if your users cannot view a CAPTCHA, outputting a sound file is an answer. However, according to CNET this still has some problems for even those with good hearing.

There are tons of different methods, each with their own drawbacks and positives. There's not an answer as of yet, but I think that a combination of CAPTCHA and perhaps alternatives like sound output and heuristic checking (when appropriate) is the best way to keep bots away and from spamming the users of your services.