I would submit the details to public scrutiny before actually starting. (1 or 2 days)
Then possible manipulation loopholes can still be fixed.
If someone finds something after you recieved some money things might get ugly fast.
My suggestion is:
before start:
select a (secret for now) phrase/word
publish its md5
while open:
have every user do the same
when the raffle is closed:
publish your phrase
have every user post its phrase
his ticket numbers is the md5 of "your phrase + his username + his phrase + N" where N starts at 1 and is increased to create the needed number of tickets he bought and avoid collisions
for each prize:
concatenating all submitted phrases in order of posting + a running number for each prize
calc the md5 of that
the winning ticket is the one that is nearest to that md5
(wrapping around at FF..FF and 00..00,
selecting the "higher" number in case of ties,
wrapped to 00..00 is considered higher)
repeat with the next running prize number
should be near impossible to manipulate, does not even require trust in a single person, can be veriefied by everyone
other CRYPTOGRAPHIC hashes like SHA will do too (CRC will not)
shouldn't be to hard or take to long to program (I will help if needed too)
there might be easier ways but where is the fun in that
My bad.
