title: PHP Captcha - Text Not Showing But Background to Certain Web Browser
body: <p>I encounter PHP Captcha is not displaying text to certain web browser.</p>
  <p>I tried it on my desktop using Firefox and IE, it was able to work. When I tried like other party desktop or mobile devices, it did not display the text in the captcha.</p>
  <p>At first, I thought the reason was because the font does not exist inside cPanel and causing the font not to display. Therefore, I uploaded two different fonts and try.</p>
  <ul>
  <li><code>arial.ttf</code></li>
  <li><code>NotoSans.ttf</code></li>
  </ul>
  <p>But the same problem occurred.</p>
  <p>This is how my code and File Manager look like. Please let me know if you need further detail information.</p>
  <pre><code>session_start();
  $captcha_answer = $_SESSION['captcha_answer'];
  $handle = ImageCreate (100, 40) or die (&quot;Cannot Create image&quot;); 
  $bg_color = ImageColorAllocate ($handle, 176, 26, 72); //green
  $font_color = ImageColorAllocate ($handle, 255, 255, 255);
  $font = 'NotoSans.ttf';
  
  imagettftext($handle, 20, 0, 10, 20, $bg_color, $font, $captcha_answer);
  imagettftext($handle, 20, 7, 13, 32, $font_color, $font, $captcha_answer);
  
  ImagePng($handle);
  </code></pre>
  <p><a href="http://imageshack.com/a/img537/6821/NWJHtG.png" rel="nofollow noreferrer">cPanel File Manager - Click Here to View</a></p>
  <h1>Update Solution Found</h1>
  <p>It is because HTTP &gt; HTTPS issue.</p>
  <blockquote>
  <p>Aside from the technical aspects of how Transport Layer Security works, the other facet of securely exchanging data lies in how well we apply that security. For example, if we allow a user to submit an application’s login form data over HTTP we must then accept that an MitM is completely capable of intercepting that data and recording the user’s login data for future use. If we allow pages loaded over HTTPS to, in turn, load non-HTTPS resources then we must accept that a MitM has a vehicle with which to inject Cross-Site Scripting attacks to turn the user’s browser into a pre-programmed weapon that will operate over the browser’s HTTPS connection tranparently.</p>
  </blockquote>
  <p>Source from: <a href="http://phpsecurity.readthedocs.org/en/latest/Transport-Layer-Security-(HTTPS-SSL-and-TLS).html" rel="nofollow noreferrer">http://phpsecurity.readthedocs.org/en/latest/Transport-Layer-Security-(HTTPS-SSL-and-TLS).html</a></p>