PHP将签名添加到POST请求

I am trying to make a POST request with PHP. I am trying to submit a users name along with a generated hash. The following is the code I currently have:

<?php
    if( isset($_POST["name"]) && crypt($_POST["name"],'saltgoeshere') == $_POST["hash"] )
    {
        echo "Name is ". $_POST['name']. "<br />";
        exit();
    }
    else if( isset($_POST["name"]) && crypt($_POST["name"],'saltgoeshere') != $_POST["hash"] ) {echo "Invalid/Tampered Request?"; exit();}
?>
<html>
<body>
  <form action="<?php $_PHP_SELF ?>" method="POST">
  Name: <input type="text" name="name" value="" />
  Password: <input type="hidden" name="hash" value="<?php echo crypt($name,"saltgoeshere");?>" />
  <input type="submit" />
  </form>
</body>
</html>

The users submits their name and the script creates a hash based on their input and creates a POST request with both the name and hash. The script then looks at the post request and checks if the hash that was submitted, matches the actual hash.

The problem that I currently have is generating the hash based on the users input because PHP is a Preprocessor.

Would making an AJAX request fix this issue?

Edit: I am trying to make sure the user has not tamped with the data when it has been submitted.

I am trying to make sure the user has not tamped with the data when it has been submitted.

To be very blunt: this is a very stupid reason. The user is entering data into a form and submitting it to you. They are already "tampering" with the data. It doesn't make any sense to want to sign this data in any way. Even if the "problem" of PHP being a "pre-processor" would not exist, how would this work? PHP would take the data input by the user, sign it, then submit it to itself and check the signature? You can skip this whole process and just take the input of the user, that'll have the same outcome.

You could do the signing in Javascript, but this is equally nonsense. You're providing the Javascript code which can produce a valid signature to the client... what's stopping anyone from "tampering" with the data and then producing a valid signature for it?

Something that would make sense:

  • You provide data to the user in a hidden form element and you want to check that the user did not alter this value while it was going server→client→server; in this case you can sign it with a hash and a secret which only the server knows and verify it this way. The key here is that there's a secret component on the server that the client doesn't have and can't fake.
  • In the above scenario, you can also simply use sessions. In this case you're storing the data tamper-proof on the server itself where the client has no access at all. The advantage of the above signing approach is that it keeps the server stateless, while with sessions the server has to store state. They're both working towards the same end though.
  • You want to prevent third parties from tampering with the data while it's transmitted from the client to you. The only realistic way to solve this is to use a SSL/TLS secured connection. This allows reasonably secured communication between the client and the server safe from tampering by third parties. The client will still be able to send any data to you at any time which you'll have to verify for correctness; signing or such is, again, not relevant here.