Have you tried using the fb:// protocol?
To have them like your page when they scan the qr code, it goes like this:
fb://page/(pageID)/addfan
If you need to get the pageID, replace "www" with "graph" in the Facebook url when you visit your page in a desktop browser and it will display the ID and other data.
Not only does this add them automatically, but it opens up the page in the FB app instead of the mobile browser.
As far as legality, I would assume as long as you put something like "Scan to like our page", you're in the clear. They know what they're getting into.