Well, step one is generating the random string (of course)

Next, you use the image functions (requiring the GD library) to create an image (imagecreate)

Then draw in the text string - there is a function for this (imagestring) The font you use depends on what font libraries are supported.

Next, draw in some random stuff - such as (horizontal/vertical) lines at
various random coordinates (the imageline function)

The final step is to output the image - jpg is probably safest, though png should be fine since you are unlikely to be using transparency (imagejpeg or imagepng)

What if I want to put my code on a server without the GD library? I know getting a Photo Album set up was a nightmare because of the GD library.

I wonder if it will be better to have 5-10 random images that already have characters drawn on them. Before they register check to see if the random image displayed corresponds to the string value.

Someone set something up like that here before. THey just used 1 image figuring that the site wasn't important enough for someone to write a script to bypass it, but didn't want spambots making it through.
It was basically just a password displayed in an image.

I would suggest just making a set of images and randomly going through them.
<input type="hidden" name="imgnum" value="8">
<input type="text" name="verify">

THen make sure that the imgnum value is associated with the code entered in through verify.

I think that is what I will do.

Thanks