使用用户名+乱码的MD5进行JSON请求有什么缺陷吗？

Question

So let's say I have "site1.mysite.com", "site2.mysite.com", etc. I want people (developers) to access some of the data via PHP generated JSON, but I also don't want to have to set up user accounts, sign ins, blah blah blah.

I don't want it to be open for "everybody".

What I started doing was this:

Users need to add "&user=somethingigivethem" and "key=somethingelseigivethem". These are values I provide to the user.

The key is currently the MD5 hash of the "user" and something like "53CR37P$%%" so basically:

$key_validator = md5($_GET['user'].'53CR37P$%%');

if($_GET['key'] === $key_validator){ 
    //show JSON 
} else {
    //show error 
}

Are there any major flaws in doing it this way?

Answer 1

So basically, if Joe Developer wants access, you give him a username and a key (which is an MD5 hash of his name + your salt). Joe can then make requests to your data.

If Joe wants to (ie. takes the time) he can probably figure out your hashing scheme just by trying different combinations of his username & salt values. And once he does, he'll know your salt and can access any other user's data.

I guess the question is: how valuable is this data? If you don't really care if other people get access and you really just want to keep out people who aren't too motivated to get your data, then this will work.