Ramblings & Controls from a .NET Addicted Freak!

Kevin Gearing's Blog

FormShield for .NET 2.0 Released

FormShield started out as a simple project with just one aim - to prevent automated form submission using dynamically generated images.

Not exactly a new idea - dynamically generated images requiring the user to enter the text found on the image have been around for quite a while, preventing automated sign-ups to free e-mail services such as HotMail and Yahoo, and automated whois lookups on domain names on sites such as Network Solutions.

Whilst some code exists on Code Project, there didn't however seem to be a free, easy-to-use and customisable control for ASP.NET with full designer integration that could generate the relevant images. So, looking for an excuse to delve into GDI+, FormShield was born and my idea of a 'simple' control was dropped...

... That was 2004 and this is now...

Version 2 of FormShield builds on the previous .NET 1.1 version, adding a wealth of new features, options and accessibility improvements. The most notable feature addition is the capability for FormShield to now automatically generate a spoken version of the value shown on the image to aid with accessibility legal compliance. This however is just one of a handful of major new features, not to mention the number of improvements and changes made since the previous version.

However, whilst a lot has changed, FormShield remains true to its original goals - to be 'easy-to-use', 'customisable' and to have 'full designer integration'.

No other .NET captcha control currently on the market has the number of features of FormShield, but more importantly, none of them are as customisable or have such a rich design-time experience when used in Visual Studio.

For more information, check out What's New in Version 2.0.


  • Generates BMP, GIF, JPEG or PNG images.
  • Choose the pixel format and smoothing mode used to render the image.
  • Set the height and width of the image as well as the alternate text displayed.
  • Image is built using 3 layers - Background, foreground and noise.
  • Provides 5 fill styles, 5 gradient styles, 54 hatch styles and 2 colors for each layer.
  • Set the length (static or random*) and case (lower, mixed or upper) of the automatically generated text.
  • Ability to set your own text for FormShield to use and the ability to regenerate or automatically change it on postback*.
  • Choose the type of characters you want to use to generate the text (alpha, numeric, symbols, a combination, or random).
  • Choose the fonts (when using a font based text effect) you want to use to draw the text (26 as default) as well as the font style (5 combinable styles, 17 in total).
  • Choose the default, static font to use to draw the text when not using a font based text effect*.
  • Pick a text effect (5 combinable effects, 25 in total) and decrease the noise level to decrease readability.
  • Draw a border around the image using one of 5 styles and your choice of color and width.
  • Randomise the fill style, gradient style, hatch style, font style, text case, character type, text effect and border style.
  • 6 Presets included; Default, Fire, Forest, Sand, Sea and ChessBoard.
  • Supports 4 persistent methods; ViewState, ControlState*, SessionState or HiddenField - ideal if ViewState and/or SessionState aren't available to persist property values on postback.
  • Values stored using any of the persistent methods are automatically encrypted for additional security (128 bit encryption*) with the ability to add your own key to the web.config file*.
  • ValidFrom and ExpiresAfter properties to set how many seconds have to pass before the image is valid and how many seconds after which the image has expired* - Prevent replay attacks.
  • ImageClick event raised when someone clicks on the image (supports Regenerate to generate a new value, BubbleEvent to bubble the event for custom handling or both)*.
  • Full embedded sound support (2 voices as standard, 8bit or 16bit and 8kHz or 16kHz - all selectable) - Will prompt to download the audio file if no plugin is installed.*
  • SoundLibraries distributed seperately so you only need to copy the one you require to your bin directory.*
  • Three additional icons rendered with customisable properties (AlternateText, Height, Width, IconUrl, Visible). Renders default icons if IconUrl is empty.*
  • Refresh icon to automatically regenerate the text value (can also raise an event for custom handling), Sound icon for built in audio playback and Help icon with customisable DestinationUrl property.*
  • Image and sound is rendered on demand (via an HttpHandler*), not saved as a file and audio files support caching (with an encrypted filename)*.
  • Encrypts the querystring (128 bit*) to prevent deciphering by reading the HTML source.
  • Works with existing ASP.NET validation controls as well as StringCompareValidator.
  • Can be used on standalone WebForms as well as UserControls.
  • Supports Community Server 2007* and .Text Blogging Engine to prevent spam on blogs.
  • Tested in IE6 & IE7 (PC), IE5 (Mac), FireFox 2 (PC & Mac), Safari 2 (Mac), Safari 3 (PC), Opera 9 (PC)*
  • Full, rich, Visual Studio .NET designer integration, including rendering whilst in design mode and menu options to automatically add configuration settings to the web.config file.
  • Works in a 'ViewState Disabled' environment. 
  • Compatible with Medium Trust environments*.

* New in Version 2.

Simple Online Demo (also see the comments section below)



Design Time:

Properties Screenshot 1 | 2 | 3

Visual Studio .NET Design Time Notes:

  1. To get the image to appear when you first drag 'n' drop FormShield to your page, right click on the control and select both 'Add Secret Key' and 'Add HttpHandler', then save the file and right click on a blank space on the page and click 'Refresh'. If that doesn't work, hit the page in a Web browser and repeat the refresh process. You may also need to open, save and close the web.config file.

  2. On occasion the image doesn't reflect property changes made within the property grid. This seems to be either an issue with Visual Studio, or caching. The easiest way to solve the problem (if it happens in the first place) is to save the file and to repeat the refresh process described above. If you are changing image design properties you can also try placing your mouse cursor into the relevant dropdown list and use the cursor keys to navigate through the options.


Simply download, add to your toolbox, drag 'n' drop to your page and set the relevant properties using the property grid.

To combine with a validation control (e.g. StringCompareValidator), add the validation control as well as a TextBox to your page, set the StringCompareValidator's 'ControlToCompare' property to point to the FormShield control and the 'ControlToValidate' property to point to the TextBox control. You will also need to set 'EnableClientScript' to False on the validator if 'EncryptQueryString' is set to True on the FormShield control.

To change the HttpHandler name/path, update your web.config file and change the HttpHandlerPath property value to point to the new handler.

To specify your own secret key for encryption, add/change the 'formShield_SecretKey' AppSetting in the web.config file.

Licensing & Download:

FormShield v2 is released as 'Donationware', for more information, please click here.

However - You don't have to donate unless you want to - FormShield can still be used for free for both personal and commercial use, however it will periodically (about 10% of the time) render '' as the image text and will play 'This control is provided by' before the text value when someone clicks on the sound icon (again, about 10% of the time).

If you do decide to donate (thank you!), you will be e-mailed a license key as soon as possible with instructions on how to add it to FormShield so that it removes the '' adverts.

Whether you have donated or not, you may also redistribute the control royalty free, providing that you don't charge for it. Also, if you intend to distribute the control as part of an application which is publicly available it would be nice to know, although this isn't a requirement.

Got a good image design? Drop me a line using the contact link and I'll look to include it as a preset. 

To download, please visit the 'Downloads' area.


Help & Support:

Please post in the forum.


Revision History: 

Updated 17/07/2007 (v2.0.1):

  • AddUpperLower property added to enable/disable the adding of 'Uppercase' or 'Lowercase' before each character when the sound is played.
  • MultiView design-time issue ('control collection cannot be modified during databind...') - Fixed.

To use this version you will also need to download v1.0.1 of the Sound Libraries.

Updated 13/07/2007 (v2.0.0):

Click here for the changes in this version. 

For the previous .NET 1.1 version, please click here.

Published Jul 13 2007, 10:02 AM by dotNetFreak
Filed under: ,



Dave Burke said:

blog bits Julian Bucknall blogs on one of my favorite Community Server topics, his experience with the

July 14, 2007 5:55 PM

Community Blogs said:

blog bits Julian Bucknall blogs on one of my favorite Community Server topics, his experience with the

July 14, 2007 6:18 PM

Dave Burke's Community Server Bits said:

Kevin Gearing releases a sophisticated Captcha control which includes sound support called FormShield

July 14, 2007 8:53 PM

Yuval said:


I am trying to use the new control but it can't seem to work. whenever I add it to my design view, I receive the following error:

"An unhandled exception accured, the control collection cant be modified during databind, init, load, prerender or unload phases".

Do you know how I can over come this problem?

Thank you,


July 15, 2007 12:01 AM

ryan said:

Wow, this is really cool. I'll find time to clean up my Captcha code and try this, great work!

One suggestion, that may help you bank a little more, any way an app could be created that would allow a licensed user to record their voice for the soundbites? ... just a thought.

best Captcha evah!

July 15, 2007 3:46 AM

Kevin Gearing said:

Yuval: Please see my e-mail.

Ryan: Thanks for the feedback. In theory, this would be possible. It is a bit fidly to create the sound files that FormShield uses as they have to be of a certain type as it automatically strips the headers and rebuilds them.

For the moment I can create additional sound library's for people if they provide the voice samples.

In a future version I may move the SoundLibrary configuration to the web.config file and write some instructions on how to create the files, so that anyone can add them.

July 15, 2007 11:53 AM

Jeff Bishop said:

I would love to implement th is on my web site, h owever it appears that this control is not functioning with Internet Explorer 7.0.  Any clues as to why?

July 15, 2007 5:06 PM

Kevin Gearing said:

Hi Jeff,

What problem are you having with FormShield & IE7? I just tried my online demo and it works absolutely fine?

July 15, 2007 5:26 PM

Jeff Bishop said:

Here is a post we sent to a Microsoft individual about this to see if we can get this worked out.  This would be great to get working in IE7 because I would love to add this to my site to eliminate the thousands of spam posts I get per week.  It is important that the audio captcha works as the site is intended for blind visitors.

Here is the note:

There seems to be a strange problem when pressing enter or even left clicking the mouse on certain controls that simply play media files.  Right clicking

and selecting any of the three open options works fine.  Here's a specific example: 

1.  Follow this link:

2.  Select the "listen" link by pressing enter.

3.  Observe the "Click here to run ActiveX control".

4.  Press enter.

5.  Either nothing happens at all or IE crashes completely.

6.  Instead, right click or use the context key or press Shift+F10.

7.  Select any of the three "open" options.

8.  You get a typical open/save type dialogue.

9.  Select open.  The CAPTCHA audio plays in the default media player. 

Any ideas on this? 

July 15, 2007 6:33 PM

Jeff Bishop said:

It appears as though you are requiring mixed case CAPTCHAs on your comment form.  If this is going to be done, then the speech should indicate the capital state of the character should be spoken.  Can this be implemented?

July 15, 2007 6:39 PM

Impedance Mismatch said:

Tempo fa (un annetto almeno) segnalai sul mio blog un bel tool CAPTCHA fatto da Kevin Gearing. Ora Kevin

July 15, 2007 8:34 PM

Jeff Bishop said:

The IE7 issue is resolved by resetting back to factory defaults in IE7 and selecting all file associations in Windows Media Player 11.  Both had to be done to fix it.  So, the only remaining issue for me is the capitilization issue for the verbal feedback.  Great news!!!

July 15, 2007 10:16 PM

Kevin Gearing said:

Hi Jeff,

Ah, I had just installed IE7 and hadn't changed any settings and also my WMP11 has all file associations selected which explains why I didn't have any issues.

With regards to the capitilisation for the sound, yes this can be done and I will look to implement and release it today.

July 16, 2007 11:01 AM

want to use accessible captcha? here’s one way « it only matters if you care said:

Pingback from  want to use accessible captcha? here’s one way « it only matters if you care

July 20, 2007 1:31 PM

Anthony Planz said:

A very cool tool!!

Thank you so much I try to convince my Boss to donate!!



August 19, 2007 8:26 AM

Femi Ojemuyiwa said:

Excelent stuff!! How do I DONATE?? Also I'm using it in an asp multiview control in the 2nd view index I.e viwindex = 1 The control doesn't render unless refreshed! Iguess I'll try loading it programatically!!

October 3, 2007 3:56 PM

Jeff said:

Great tool!  When I implemented it on a secure site I'm working on, I notice that when this loads I get the popup that the page is not secure since it looks like the image is being served up via a http call.  If I click no to leaving a secure site, the image doesn't display, whereas if I click yes it does.  I thought the dll rendered the image and there shouldn't be a need to call back to a url.  Can you lend any insight on how to resolve this?


December 8, 2007 1:19 PM

z said:

Hi. Great Tool. Really wonderful. Is there any chance of an american voice though?

September 28, 2008 7:35 PM

sunil said:

I can't get the Audio to work. Each time i click on it i get a HttpException ( Session object is not available). Any comments?


October 30, 2008 9:04 PM

Kevin Gearing said:

It sounds as if Sessions are disabled within your Web application - Are you able to double check if this is the case?

October 31, 2008 11:16 AM

lokastinor said:

A very cool tool!!

Thank you so much I

November 1, 2008 8:14 PM

New Control - FormShield - Dynamically Generates CAPTCHA??? Style Images - Kevin Gearing's Blog said:

Pingback from  New Control - FormShield - Dynamically Generates CAPTCHA??? Style Images - Kevin Gearing's Blog

February 17, 2009 5:01 PM

Kevin Gearing's Blog said:

FormShield v2.0.1 has been released. Click here for details.

February 17, 2009 5:05 PM

Pedro Jimenez said:

I just can't figure out a code in a website.Its the same you have hear and it keeps on say I have typed the code incorrectly.

February 27, 2010 11:07 PM

Pedro Jimenez said:

I just can't figure out a code in a website.Its the same you have here and it keeps on say I have typed the code incorrectly.

February 27, 2010 11:08 PM

Pedro Jimenez said:

I just can't figure out a code in a website.Its the same you have here and it keeps on saying I have typed the code incorrectly.

February 27, 2010 11:08 PM

Kevin said:

I get the same as you Pedro Jimenez - every time it says I have typed the code incorrectly - when I haven't...

January 19, 2011 6:51 PM

turban resimleri said:

Here is the query that demonstrates cache plans which are ‘ad hoc’ or called only once in a life time.

February 15, 2017 10:31 PM

Leave a Comment


Protected by FormShield
Please enter the characters shown on the image


Copyright ©2004-2007 Kevin Gearing. All Rights Reserved.
Powered by Community Server (Non-Commercial Edition), by Telligent Systems