Isn’t this captch_code taking a random character each time in the for loop? Why does it become a string when it is stored in the session after the loop ends? There is no splicing.