PHP升级reCAPTCHA V1至V2遇异常：stream_context_create与file_get_contents问题

Hey there, let’s cut straight to solving your reCAPTCHA upgrade headaches—with your deadline looming, I know you need actionable fixes fast. Let’s break down your two issues first:

1. stream_context_create() returning Resource id #8 is NOT an error! #

That resource ID is PHP’s way of telling you it successfully created a valid stream context. Resources in PHP are just handles for external data/connections, so this is actually a sign that part of your code is working as intended. No need to worry about this one—focus on the second issue instead.

2. file_get_contents() returning an empty array (or false) #

This is the real problem stopping your verification flow. Let’s walk through the most likely fixes and debugging steps:

First, double-check your core setup #

• Confirm your reCAPTCHA V2 secret key: Make sure you’re using the server-side secret key from the reCAPTCHA admin console (not the client-side site key). V1 keys won’t work with V2’s API.
• Verify the API endpoint: The correct V2 verification URL is https://www.google.com/recaptcha/api/siteverify—don’t mix this up with V1’s old endpoint.
• Ensure your POST data includes required fields: You must pass secret and response (the value from the client’s g-recaptcha-response form field). The remoteip parameter is optional but recommended for security.

Debug file_get_contents() failures #

file_get_contents() can be flaky for external requests, especially if your server has restrictions. Add error checking to see what’s going wrong:

$postdata = http_build_query([
    'secret' => $privkey,
    'response' => $_POST['g-recaptcha-response'],
    'remoteip' => $_SERVER['REMOTE_ADDR']
]);

$context = stream_context_create([
    'http' => [
        'method' => 'POST',
        'header' => 'Content-type: application/x-www-form-urlencoded',
        'content' => $postdata
    ]
]);

$verifyResponse = file_get_contents('https://www.google.com/recaptcha/api/siteverify', false, $context);

// Check for errors
if ($verifyResponse === false) {
    $error = error_get_last();
    var_dump($error); // This will show you why the request failed (e.g., SSL issues, timeout, blocked connection)
} else {
    $responseData = json_decode($verifyResponse, true);
    var_dump($responseData); // Inspect the full API response
}

Common issues here include:

• allow_url_fopen disabled in php.ini: If you can’t enable this, switch to cURL (see below).
• SSL verification failures: Your server might not trust Google’s SSL certificate. You can temporarily disable SSL verification (not recommended long-term) or update your server’s CA certificates.
• Firewall/proxy blocking outgoing requests: Test if your server can reach the reCAPTCHA endpoint with a command like curl -X POST https://www.google.com/recaptcha/api/siteverify -d "secret=YOUR_KEY&response=TEST_RESPONSE".

Switch to cURL (more reliable than file_get_contents) #

cURL is more robust for external API calls and avoids issues with allow_url_fopen. Here’s a full working example:

$privkey = 'your_v2_secret_key';
$userResponse = $_POST['g-recaptcha-response'];
$userIp = $_SERVER['REMOTE_ADDR'];

// Setup cURL request
$ch = curl_init('https://www.google.com/recaptcha/api/siteverify');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'secret' => $privkey,
    'response' => $userResponse,
    'remoteip' => $userIp
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Keep this enabled for security

// Execute and parse response
$verifyResponse = curl_exec($ch);
curl_close($ch);

$responseData = json_decode($verifyResponse, true);

// Handle verification result
if ($responseData['success']) {
    // Proceed with your application logic (e.g., form submission)
    echo "reCAPTCHA verified successfully!";
} else {
    // Show error details (for debugging only—hide in production)
    $errorCodes = $responseData['error-codes'] ?? [];
    echo "Verification failed. Errors: " . implode(', ', $errorCodes);
}

Final Tips #

• Always validate the success field in the API response—don’t rely on just the presence of data.
• In production, avoid dumping error codes to users; log them instead for debugging.
• If you’re still stuck, check the reCAPTCHA admin console for any alerts about your key (e.g., wrong domain/IP restrictions).

内容的提问来源于stack exchange，提问作者user3616128