Randomly Generated Verification COde...

Short, practical pattern to add a verification code to the ASP.NET/C# page @vishalrane started: generate a cryptographically strong code, store it server-side with an expiry, render it as an image from a small handler, and verify on postback. That keeps logic out of HTML/CSS (so @yusuf_3's layout tip helps placement but does not replace server-side checks).

Example: secure token generator (use this to create and store the expected code in Session).

private string GenerateCaptchaCode(int length = 6)
{
    const string chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
    var bytes = new byte[length];
    using (var rng = System.Security.Cryptography.RandomNumberGenerator.Create())
    {
        rng.GetBytes(bytes);
    }
    var result = new char[length];
    for (int i = 0; i < length; i++)
        result[i] = chars[bytes[i] % chars.Length];
    return new string(result);
}

Render the image from an .ashx or dedicated endpoint (minimal example: draw the stored Session code, add simple noise, write PNG to Response). Keep the image handler code small and stateless except for reading the Session value.

Validate on postback by comparing the user input to the Session value (case-insensitive), then remove the Session entry and check a timestamp to expire old tokens. Example checks: compare with StringComparison.OrdinalIgnoreCase, clear Session on success, and reject if older than a few minutes.

Notes and cautions: avoid System.Random for token generation; use a crypto RNG. System.Drawing/GDI+ is fine for classic ASP.NET 2.0 but can be heavy on very high traffic—consider an external CAPTCHA service or an audio alternative for accessibility. Also add simple rate-limiting and invalidate the code on first use to prevent replay.