DEV Community

Ana Elena Ulate Salas
Ana Elena Ulate Salas

Posted on

🐾 Building a Secure Comment System in Laravel (with ID Authentication and Arithmetic CAPTCHA)

#php #laravel #webdev #backend

In this post, I’ll share how I developed a small but complete comment system in Laravel 12, focused on authentication, data validation, and basic security.
The project is called Pet Shop – Comment System, and it was a great opportunity to practice good coding practices and understand Laravel’s core features.

🎯 Project Goal

The main goal was to build a functional web application that simulates a login process, comment submission, and message confirmation — applying Laravel’s validation and security features.

I wanted to create something minimal yet complete, that demonstrates the foundations of modern Laravel development.

⚙️ Tech Stack

  • Laravel 12 (PHP 8.2+)
  • MySQL / MariaDB
  • Bootstrap 5 (via CDN)
  • Blade Templates
  • Artisan CLI

🔐 ID-Based Authentication

Instead of using an email address for login, I implemented authentication by ID number, a method often used in local systems.
This allowed me to create custom validation rules and flexible user management.

In the AuthController, the login logic works like this:

$request->validate([
    'cedula' => 'required|numeric',
    'password' => 'required|min:6'
]);

$user = User::where('cedula', $request->cedula)->first();

if ($user && Hash::check($request->password, $user->password)) {
    Auth::login($user);
    return redirect('/home');
} else {
    return back()->withErrors(['login' => 'Invalid credentials']);
}
Enter fullscreen mode Exit fullscreen mode

This manual authentication flow helped me understand Laravel’s internals without relying on Breeze or Jetstream.

🧮 Arithmetic CAPTCHA

To prevent automated logins and spam, I implemented a simple arithmetic CAPTCHA that randomly generates addition, subtraction, or multiplication problems.

Here’s a simplified version of the logic:

$num1 = rand(0, 9);
$num2 = rand(0, 9);
$operator = ['+', '-', '*'][rand(0, 2)];

switch ($operator) {
    case '+':
        $result = $num1 + $num2;
        break;
    case '-':
        $result = $num1 - $num2;
        break;
    case '*':
        $result = $num1 * $num2;
        break;
}

session(['captcha_result' => $result]);
Enter fullscreen mode Exit fullscreen mode

When the user submits the form, the validation checks if the provided answer matches the stored result:

if ($request->captcha != session('captcha_result')) {
    return back()->withErrors(['captcha' => 'Incorrect CAPTCHA result.']);
}
Enter fullscreen mode Exit fullscreen mode

It’s a simple, effective solution that doesn’t require external APIs.

💬 Comment System

Once logged in, users can create comments about services such as baths, walks, or grooming.
Each comment requires a minimum length and must belong to one of the predefined services.

$request->validate([
    'content' => 'required|string|min:10',
    'service' => 'required|in:banos,paseos,cortes'
]);

Comment::create([
    'user_id' => Auth::id(),
    'service' => $request->service,
    'content' => $request->content,
]);
Enter fullscreen mode Exit fullscreen mode

After submission, the user is redirected to a simple confirmation view:

<h2>Comment submitted successfully 🐾</h2>
<p>Your feedback is very important to us.</p>
Enter fullscreen mode Exit fullscreen mode

📂 Project Structure

The system follows Laravel’s standard folder organization, keeping logic separated into controllers and models:

app/
├── Http/Controllers/
│   ├── AuthController.php
│   ├── CommentController.php
│   └── HomeController.php
└── Models/
    ├── Comment.php
    └── User.php
resources/views/
├── layouts/
├── comments/
└── auth/
routes/web.php
Enter fullscreen mode Exit fullscreen mode

📚 Lessons Learned

  1. Manual authentication – Building a login flow from scratch helps you understand Laravel’s core security features.
  2. Validation rules – Laravel Validation makes it easy to express complex rules in a clean way.
  3. Lightweight CAPTCHA – Sometimes a simple arithmetic CAPTCHA is all you need for basic security.
  4. UX & Accessibility – Clear validation messages and confirmations improve usability.
  5. Simplicity matters – Even small projects can teach big lessons about architecture and clean code.

🚀 Next Steps

Some planned improvements include:

  • Adding unit tests using Pest or PHPUnit
  • Building an admin dashboard for comment moderation
  • Integrating email notifications for confirmation messages

🐶 Conclusion

This project helped me strengthen my skills in authentication, validation, and secure data handling using Laravel.
It’s a reminder that even simple projects can teach a lot about quality, structure, and accessibility.

👉 You can check the full code here:
🔗 GitHub – Animal Shop (Pet Shop - Comment System)

Technical note: The code shown in this article is a simplified version of the real project, with minor variable name and syntax differences, but it preserves the exact same logic and functionality.

Top comments (0)