You don't need AJAX or anything other than using POST commands over a secure channel.
At a very high level these are the steps:
Step 1 - The signup page.
Utilize https for any signup pages that include sensitive information. Because the user will be sending their e-mail address and phone number this must be https.
- Post the account information including the phone number in which the
SMS should be sent to.
- Create a random verification code
- Store the verification code along with the new account sign up
- Send the SMS message with only the verification code
Then redirect the user to the verification page. This page only needs to accept the verification code. Remember that all you are doing is ensuring that the person that has access to the phone is also the same person with the account information. You can't stop someone from being malicious if they have someone else's phone. The phone is called "Something you have" in security terms.
Step 2 - The verification page
- Post the verification code. This assumes you are using any one of
the number technologies that tracks state through session ids.
- Look up the account id in memory using the current session. This
information should already be readily available. Then confirm that
the verification code is the same one that is stored in the
database. This isn't a password so I don't see a reason to hash this
information. It's a one-user throw away code. It doesn't matter if
someone else gets it later.
- If the verification code matches mark the user as verified. Now you
know that this account has access to a specific phone number.
I've included a rudimentary diagram for reference.