[Pyrix]

Sorry, but this is incredibly easy to bypass - in fact I can think of two ways that this can be done...

MD5 Hash Table.
I could easily create a small array of hashes for each 'possible' answer. As the chances are that most of the time the character will be alphanumeric, i will only need A-Z,a-z and 0-9. All i have to do is hash each of these letters in turn and store them in a small array (62 cells)

For example

$answer[0cc175b9c0f1b6a831c399e269772661] = 'a'
$answer[92eb5ffee6ae2fec3ad71c777531578f] = 'b'

Now all i have to do is look up the value stored in the array with the key that matches your 'hidden field' value and put that letter in the field.

Look at the webpage
Alternatively, I could just look at the webpage. Unless I'm missing something, you give me the username in plain text. All i have to do is look for the value given after 'What is the first character of '?

This is the very reason that vBulletin uses CAPTCHA - it's an image so cannot just be 'read' in this way.

You may however get some 'security through obscurity' - bots need to know about your hack before they know what to do. But that would only take time and popularity.

Sorry to rip it apart so badly, but you did ask if there was any way bots could get past it.

Keep at it

Ollie