Comment by undersuit

Don't store the hash the client sent you. Hash the hash on the server side.