Getting through captcha

The CAPTCHA code is stored in a session, once this has been submitted the session variable is destroyed so you have to generate a new CAPTCHA code and submit is again.

The JavaScript they use doesn't matter at all. The problem is your own code you posted before, it is VERY dangerous for  the reason that I listed earlier as you do not parse the user submitted data before you use it.

You need to go back to your own code and parse each and every piece of data submitted removing any malicious code before you use it. This has to be done server side, not using JavaScript.

You should never use Request("xxx") directly you should always place this into a variable and then parse the variable for malicious code before you use it.

This being for email pay particular attention to removing semicolons (;) as this can be used to list multiple email address for a single submission hack that will relay to 1000's of email addresses in one go.