I assume this is the source of your CAPTCHA image (for example, the file "image.php"), and it is downloaded from another location (for example, from "captcha.php" using <img src="image.php" /> ). You may need to include session_start() in the captcha.php file.
From the code you posted, just remove all the HTML.
Also, as a rule, never send the type of image content until you are ready (and, if necessary, check for errors first.)
<?php session_start(); $md5 = md5(microtime() * time() ); $string = substr($md5, -5); $captcha = imagecreatefrompng("./captcha.png"); $black = imagecolorallocate($captcha, 0, 0, 0); $line = imagecolorallocate($captcha,233,239,239); imageline($captcha,0,0,39,29,$line); imageline($captcha,40,0,64,29,$line); $_SESSION['key'] = md5($string); imagestring($captcha, 5, 20, 10, $string, $black); Header('Content-type: image/png'); imagepng($captcha); ?>
NOTE : you are using MD5 string MD5. It's right? Why not use uniqid() instead of md5(microtime() * time() ) and save $md5 in _SESSION ?