Returning a Secure "Winning Code" to User - php

Question

This is probably a very basic/introductory thing, but let me paint a scenario:
Let's say I'm using jQuery to do some sort of mini quiz game on my site. The user clicks the correct answer, and then a window pops up with a secret "winner's code" that they can redeem elsewhere.
How can I generate the winner's code so that it doesn't just appear in the HTML and in a way that users cannot reverse-engineer it (at least without considerable effort)?
I mean, if I just generated an encoded string containing their username and some sort of additional information only I know, that would work, right? Or MD5 hash or something, but how do I make it so the winner's code itself doesn't appear in the HTML, and only when the correct answer is chosen?
Thank you for any suggested reading/tutorials/assistance/advice you can offer.

Answer 1

If I understood you correctly, you just want the code to appear whenever the correct answer is chosen?
If so, just have a PHP page to which you send the answer the user chose in a GET/POST variable. Then, have that PHP page show the code only if the answer was correct. That way it won't be in the HTML if the answer is incorrect.
So for example, your PHP page would look like:
<?php
if ($_GET["answer"] == "correct_answer") {
echo "give the code here";
} else {
echo "sorry the answer was incorrect";
}
?>
Additionally, if you want the above to appear in a javascript popup or something, fetch it using Ajax.

Answer 2

There are a couple of questions there.
1) How to generate a secure code:
if you are implementing a 'winner code' you could use an hashed iv + secret + user information, or some signing mechanism. You could also implement a code expiry time on the server so that you could further raise the bar, if necessary.
2) Getting the code to the winning user:
If you don't want the code to appear in the html, then you want to use ajax to get it. Then inject the code into the DOM where you want to display it. Further, you should be using a secure SSL channel to do this so that you guard against sniffing. Even further, consider some kind of 'one-time' token so that a man-in-the-middle cannot repost your code request and receive the same win code.
Hope this gives you something to consider.

Answer 3

First of all, for the game to be secure at all, all evaluation of winning MUST be done on a server and all redeemable codes must be uniquely created on the server and sent to the client.
It simply cannot be done on the client in a secure fashion because ALL javascript code is available for inspection by anyone. There are means of obscuring javascript code to make it more of a pain for someone to reverse engineer, but that cannot stop a determined hacker - it can only slow them down or slightly deter them. The only place where your code/algorithms for evaluating the results of the game is safe and free from manipulation is on your server.
Even then, you probably need to do something to keep one user from getting a redeemable code and then sharing it with lots of other people or getting the right answer and then having someone else write a script that submits the right answer to your server to generate limitless codes.