Resolving PHP Captcha Display Issues on a Production Server

Today I encountered a strange bug: a PHP program that runs fine locally fails to display the captcha on the client’s server.

In Chrome the captcha appears as a broken‑image icon; opening it in a new window shows the same broken image, and no PHP error is shown even with Xdebug enabled, indicating that the routing and business logic are correct and the problem lies in the image generation.

Debugging steps:

1) Verify that the GD extension is installed correctly (use yum, apt, pecl on Linux or phpStudy on Windows).

2) Ensure the font used by the captcha is present; many captcha components rely on system fonts, but the ThinkPHP think-captcha package includes its own fonts, so this is usually not an issue.

3) Download the faulty captcha image and a working one, open them in a text editor and compare the binary content.

The comparison shows that the broken file contains extra bytes “EF BB BF” (a UTF‑8 BOM) at the beginning, while the rest of the file is identical, suggesting that the server added the BOM when the PHP file was edited with a plain Windows Notepad.

Two ways to solve the issue: add ob_clean() before the imagepng() call in the captcha script, or use a tool to batch‑remove BOM headers from the source files.

In the ThinkPHP captcha source, inserting ob_clean() before line 203 of Captcha.php eliminates the problem permanently.

For environments with strict performance or stability requirements, batch removal of BOM is safer, and it is advisable to install a professional editor such as EditPlus on the server.

Avoid editing PHP code with Windows Notepad.