How to correct captcha code?

Question

PHP

There are 2 files
5.php

<?php header("Content-Type: text/html; charset=utf8"); ?>

<form action="" method="post">
    <input type="text" name="coded"><p />
    <img src="6.php" alt="" /><p />
    <input type="submit" name="subu" value="отправить"><p />
</form>
<?php

$code_capcha = $_POST['coded'];
    if(isset($_POST['subu'])) {
        if($code_capcha == $_COOKIE['coded']) {
        echo "<font color='green'> Верно </font>";
        }

else {
    echo "<font color='red'> Неверный код </font>";
   }
}

?>

6.php

<?php
header("Content-Type: image/png;");
setcookie("coded");
$image = imagecreatetruecolor(120, 30);
    $red = imagecolorallocate($image, 255, 0, 0);
    $black = imagecolorallocate($image, 0, 0, 0);
    $w = imagecolorallocate($image, 255, 255, 255);
    
    imagefill($image, 0, 0, $red);



 $cap_array = array("a","b","c","d","e","f","g","h","j","k","l","m","n","o","p","q",
  "r","s","t","u","v","w","x","y","z","0","1","2","3","4","5","6","7","8","9");
    for($i = 0; $i <= 4; $i++) {
    $code_capcha .= $cap_array[rand(0, count($cap_array) - 1)];   
    
}
$_COOKIE['coded']= $code_capcha;
    
    imagestring($image, 5, 40, 5, $code_capcha, $w); 
    imagepng($image);
    imagedestroy($image);
?>

I’ve been studying PHP recently, I can’t catch up why when I press the send button, just an empty input displays “Correct”, and when I enter the input (incorrect or correct value, it doesn’t matter), it displays incorrectly, I don’t understand, or the code is completely wrong or I haven’t added something, help me to finalize the code.

Answer 1

in 6.php remove setcookie("coded");which is at the top.
instead of $_COOKIE['coded']= $code_capcha;writing
And in general, this is the wrong approach. The bot can read the value of your cookie. It is better to save in session.

Answer 2

setcookie("coded");
Programmer: Dear php, put the captcha value in this cookie.
*Demonic laughter, hellfire reflections*
php: Muahaha, he thinks he's writing to the cookie this way, but he's really just updating the global array with past cookie data. I'll just throw out this array at the end of the script and the user will get an empty cookie that the programmer set initially! Brilliant plan!