Register page problem.

Question

I am so confused, I want to add some anti-spam security to my upcoming register page but something is really wrong.
Note that my server is Coldfusion MX7 (i can not afford better) and because of that i can not use
cfimage(captcha).
This is what i have:
<cfset strLowerCaseAlpha = "abcdefghijklmnopqrstuvwxyz">
<cfset strUpperCaseAlpha = UCase( strLowerCaseAlpha )>
<cfset strNumbers = "0123456789">
<cfset strAllValidChars = (
    strLowerCaseAlpha &
    strUpperCaseAlpha &
    strNumbers
    )>
<cfset arrPassword = ArrayNew( 1 )>
<cfset arrPassword[ 1 ] = Mid(
    strNumbers,
    RandRange( 1, Len( strNumbers ) ),
    1
    )>
<cfset arrPassword[ 2 ] = Mid(
    strLowerCaseAlpha,
    RandRange( 1, Len( strLowerCaseAlpha ) ),
    1
    )>
<cfset arrPassword[ 3 ] = Mid(
    strUpperCaseAlpha,
    RandRange( 1, Len( strUpperCaseAlpha ) ),
    1
    )>
<cfloop
    index="intChar"
    from="#(ArrayLen( arrPassword ) + 1)#"
    to="8"
    step="1">
    <cfset arrPassword[ intChar ] = Mid(
        strAllValidChars,
        RandRange( 1, Len( strAllValidChars ) ),
        1
        )>
</cfloop>
<cfset strPassword = ArrayToList(
    arrPassword,
    )>
<cfif IsDefined("FORM.spamcode")>
    <cfif form.spamcode neq strPassword >
    not equal
    <cfelse>
   finally working
</cfif>
</cfif>
                 <cfif isdefined ("strPassword")>
                 <cfoutput>#strPassword#</cfoutput>
                 </cfif>
<form action="" method="post">
  <label>
    <input type="text" name="spamcode" id="spamcode" />
  </label>
</form>
this is just testing code but it is somehow messed up.
every time when i click on the submit button i get not equal!
I also need to add when i set up strPassword manualy instead of ArrayToList, for example
<cfset strPassword=test413> and then insert in form test413 and compare it everything is fine. You can copy/paste this code to test it. Any ideas please?

Answer 1

I get the feeling you could create the password more efficiently. But that's another matter. Your code does work.
I would generate the captcha word in a function. Then  it will be run only when necessary. Something like this:
<cffunction name="getPassword" returntype="string">
<cfset var strPassword = "">
<cfset var strLowerCaseAlpha = "abcdefghijklmnopqrstuvwxyz">
<cfset var strUpperCaseAlpha = UCase( strLowerCaseAlpha )>
<cfset var strNumbers = "0123456789">
<cfset var strAllValidChars = (
    strLowerCaseAlpha &
    strUpperCaseAlpha &
    strNumbers
    )>
<cfset var arrPassword = ArrayNew( 1 )>
<cfset arrPassword[ 1 ] = Mid(
    strNumbers,
    RandRange( 1, Len( strNumbers ) ),
    1
    )>
<cfset arrPassword[ 2 ] = Mid(
    strLowerCaseAlpha,
    RandRange( 1, Len( strLowerCaseAlpha ) ),
    1
    )>
<cfset arrPassword[ 3 ] = Mid(
    strUpperCaseAlpha,
    RandRange( 1, Len( strUpperCaseAlpha ) ),
    1
    )>
<cfloop index="intChar" from="#(ArrayLen( arrPassword ) + 1)#" to="8"  step="1">
    <cfset arrPassword[ intChar ] = Mid(
        strAllValidChars,
        RandRange( 1, Len( strAllValidChars ) ),
        1
        )>
</cfloop>
<cfset strPassword = ArrayToList(arrPassword,"")>
<cfreturn strPassword>
</cffunction>
<!--- Set the default captcha string, if none yet exists --->
<cfparam name="session.current_captcha" default="#getPassword()#" type="string">
<cfif IsDefined("FORM.spamcode")>
    <!--- compare() makes case-sensitive comparison of two strings, character for character --->
    <cfif compare(form.spamcode, session.current_captcha) eq 0>
         proceed: user entered the correct code
    <cfelse>
           stop spam: user entered the wrong code
    </cfif>
    <!--- Create new captcha every time user submits form --->
    <cfset session.current_captcha = getPassword()>
</cfif>
<cfoutput>
<form action="#cgi.SCRIPT_NAME#" method="post">
    <input type="text" name="spamcode" id="spamcode"><span><em>enter this exact code:</em> <strong>#session.current_captcha#</strong></span>
    <br>
    <input type="submit" name="sbmt" id="sbmt" value="Test it!">
</form>
</cfoutput>