使用md5将密码保存和比较为二进制数据库

3 回答

• 4

  比较密码时 - 您需要在他们提交的密码上计算MD5 .

  所以在你的代码中你想要这样的东西：

  MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
  //create an array of bytes we will use to store the encrypted password
  Byte[] hashedBytes;
  //Create a UTF8Encoding object we will use to convert our password string to a byte array
  UTF8Encoding encoder = new UTF8Encoding();
  
  //encrypt the password and store it in the hashedBytes byte array
  hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(txtPassword.Text));
  
  //set the password they are using now to password for the compare:
  Password = hashedBytes;
  

  然后，您可以运行比较代码 . 关键是数据库中的密码是您在注册时计算的原始hashedBytes

  EDIT: 这里是你的原始代码：

  SqlConnection con = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
  con.Open();
  string UserName = txtUserName.Text;
  string Password = txtPassword.Text;
  
  //hash password
  MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
  Byte[] hashedBytes;
  UTF8Encoding encoder = new UTF8Encoding();
  hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(Password));
  Password = hashedBytes.ToString();
  
  bool isMatch = false;
  SqlCommand cmdd = new SqlCommand(string.Format("select * from Users where UserName='{0}'", UserName),con);
  SqlDataReader dr = cmdd.ExecuteReader();
  while (dr.Read())
  {
      if (dr["password"].ToString()==Password)  
      {
          isMatch = true;
      }
  }
  dr.Close();
  con.Close(); 
  if (isMatch)
  {
      Response.Write("correct");
  }
  else
  {
      Response.Write("Incorrect username or password!");
  }
  

  Updated the code for the conversion error

  Try this code to see the passwords 这将打印出哈希的密码和数据库中的密码 - 如果它们不匹配你就有问题（可能是盐问题）

  Byte[] hashedBytes;
  string Password = txtPassword.Text;
  MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
  UTF8Encoding encoder = new UTF8Encoding();
  hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(Password));
  
  Response.Write(string.Format("Hashed Password (Given): {0}
  ", hashedBytes.ToString()));
  
  string UserName = txtUserName.Text;
  SqlConnection con = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
  con.Open();
  
  SqlCommand cmdd = new SqlCommand(string.Format("select * from Users where UserName='{0}'", UserName),con);
  
  SqlDataReader dr = cmdd.ExecuteReader();
  
  //should be only one row..
  while (dr.Read())
  {
      Response.Write(string.Format("Hashed Password (DB): {0}", dr["password"].ToString()));
  }
  dr.Close();
  con.Close();
  

  回复于 2024-04-28T15:13:49+08:00
• 0

  这是我从你的代码调整的代码，它工作正常（比较db中存储的pwd的字节到字节与用户给出的当前pwd）：

  public bool AddNewUser(string userId, string pwd, string dept,string mail,string displayName)
      {
          //get the username    
          string UserName = userId;
  
          SqlConnection conn = new SqlConnection(GetConnectionString());     //sql command to add the user and password to the database    
          SqlCommand cmd = new SqlCommand("INSERT INTO MAIN_USER_DATA(USERID, PWD,DEPARTMENT,MAIL,DISPLAY_NAME) VALUES (@USERID, @PWD,@DEPARTMENT,@MAIL,@DISPLAY_NAME)", conn);    
          cmd.CommandType = CommandType.Text;     //add parameters to our sql query    
          cmd.Parameters.AddWithValue("@USERID", UserName);   
          cmd.Parameters.AddWithValue("@PWD", GenerateHash(userId ,pwd));
          cmd.Parameters.AddWithValue("@DEPARTMENT", dept);
          cmd.Parameters.AddWithValue("@MAIL", mail);
          cmd.Parameters.AddWithValue("@DISPLAY_NAME", displayName);
          using (conn)    {        //open the connection       
              conn.Open();        //send the sql query to insert the data to our Users table 
              try
              {
                  cmd.ExecuteNonQuery();
                  return true;
              }
              catch
              {
                  return false;
              }
          }
  
      }
      public bool ValidateUser(string userId, string password)
      {
          using (SqlConnection connection = new SqlConnection(GetConnectionString())) 
          using (SqlCommand command = connection.CreateCommand())
          {
              command.CommandText = "SELECT PWD FROM MAIN_USER_DATA WHERE USERID=@USERID";
              command.Parameters.Add("@USERID", SqlDbType.NVarChar, 25).Value = userId;
              connection.Open();
              SqlDataReader dr = command.ExecuteReader();
              if (dr.Read())
              {
                  byte[] storedPwd = (byte[])dr["PWD"];
                  byte[] currentPwd = GenerateHash(userId, password);
                  for (int i = 0;i< storedPwd.Length; i++)
                  {
                      if (storedPwd[i] != currentPwd[i])
                      {
                          return false;
                      }
                  }
              }
              else
                  return false;
              return true;
          }
      }
      private byte[] GenerateHash(string userId, string password)
      {
          //create the MD5CryptoServiceProvider object we will use to encrypt the password    
          HMACSHA1 hasher = new HMACSHA1(Encoding.UTF8.GetBytes(userId));             //create an array of bytes we will use to store the encrypted password    
          //Byte[] hashedBytes;    //Create a UTF8Encoding object we will use to convert our password string to a byte array    
          UTF8Encoding encoder = new UTF8Encoding();     //encrypt the password and store it in the hashedBytes byte array    
          return hasher.ComputeHash(encoder.GetBytes(password));     //connect to our db 
      }
  

  回复于 2024-04-28T15:13:49+08:00
• 1

  C＃代码：

  public static bool ValidateUser(string userName, string password)
  {
      using (var connection = new SqlConnection("connectionString"))
      using (var command = connection.CreateCommand())
      {
          command.CommandText = "SELECT dbo.checkUserExists (@userName, @password)";
          command.Parameters.Add("@userName", SqlDbType.NVarChar, 25).Value = userName;
          command.Parameters.Add("@password", SqlDbType.NVarChar).Value = GenerateHash(password);
  
          connection.Open();
          return (bool)command.ExecuteScalar();
      }
  }
  
  private static string GenerateHash(string value)
  {
      return Convert.ToBase64String(new System.Security.Cryptography.HMACSHA1(Encoding.UTF8.GetBytes("salt")).ComputeHash(Encoding.UTF8.GetBytes(value)));
  }
  

  SQL存储过程：

  IF OBJECT_ID(N'checkUserExists', N'FN') IS NOT NULL
  DROP FUNCTION checkUserExists
  GO
  CREATE FUNCTION checkUserExists
  (
      @userName NVARCHAR(25),
      @password NVARCHAR(255)
  )
  RETURNS BIT
  AS
  BEGIN
      RETURN ISNULL((
          SELECT 1
          FROM users
          WHERE
              name = @userName
          AND password = @password
      ), 0)
  END
  

  回复于 2024-04-28T15:13:49+08:00