I know that the signing should use public key, what if the private key is used in signing the output? Does that mean anybody can use the money in your wallet? And is there any difference between P2PKH and P2SH?
Signing requires the private key, and commits the signature hash of the transaction to the signature. Altering the transaction will change the sighash, and thereby render the signature void.
The public key is required for signature validation. Only the public key hash is shared with the public in form of the address, from which the private key cannot be derived.
P2PKH and P2SH are both standard output scripts in Bitcoin.
- A P2PKH(address) output is spendable by the private key associated with the address.
- A P2SH(embedded_script) output is spendable by the embedded script and the unlocking script thereof. The P2SH output script acts as a "wrapper" for other output scripts.