Member Avatar for snowdoll

please help me with coding

  • 3 Contributors
  • 2 Replies
  • 115 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by mani-hellboy

Dani AI

Generated

: and are correct that you must check credentials in the database, but that description leaves out important security details. Do not compare plain passwords in SQL or store them as clear text. Use parameterized queries, store a per-user salt and a strong password hash (or use a vetted framework), and verify the hash on the server.

Recommended workflow:

  • Query the user row by username only (no password in the WHERE clause).
  • Retrieve the stored hash and salt (or a single stored hash blob that contains algorithm metadata).
  • Compute the hash of the supplied password using the same algorithm and parameters, then compare using a constant-time compare.
  • Enforce HTTPS, rate-limit/lockout on failed logins, and prefer built-in solutions (ASP.NET Identity) rather than rolling your own.

Example (VB.NET pattern) — fetch hash+salt and verify server-side:

Imports System.Data.SqlClient
Imports System.Security.Cryptography

Function ValidateUser(username As String, password As String) As Boolean
    Dim connString = ConfigurationManager.ConnectionStrings("MyConn").ConnectionString
    Using cn As New SqlConnection(connString)
        cn.Open()
        Using cmd As New SqlCommand("SELECT PasswordHash, PasswordSalt FROM Users WHERE Username=@u", cn)
            cmd.Parameters.Add("@u", SqlDbType.NVarChar, 256).Value = username
            Using rdr = cmd.ExecuteReader()
                If Not rdr.Read() Then Return False
                Dim storedHash = CType(rdr("PasswordHash"), Byte())
                Dim storedSalt = CType(rdr("PasswordSalt"), Byte())
                Return VerifyPassword(password, storedSalt, storedHash)
            End Using
        End Using
    End Using
End Function

Function VerifyPassword(password As String, salt As Byte(), expectedHash As Byte()) As Boolean
    Dim iterations As Integer = 10000 ' choose cost per current guidance
    Using derive = New Rfc2898DeriveBytes(password, salt, iterations)
        Dim hash = derive.GetBytes(expectedHash.Length)
        Return SecureEquals(hash, expectedHash)
    End Using
End Function

Function SecureEquals(a As Byte(), b As Byte()) As Boolean
    Dim diff = a.Length Xor b.Length
    For i = 0 To Math.Min(a.Length, b.Length) - 1
        diff = diff Or (a(i) Xor b(i))
    Next
    Return diff = 0
End Function

See OWASP for current best practices on password storage and SQL injection prevention: Password Storage Cheat Sheet and SQL Injection Prevention Cheat Sheet. For the PBKDF2 API used above, see Microsoft's Rfc2898DeriveBytes docs: (https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rfc2898derivebytes?view=netframework-4.8).

Recommended Answers

All 2 Replies

Member Avatar for Pgmer

U need to write a query to ur database passing the user name and authetincate wheter its a valid user name if yes then u need to check for the password. If both are correct and valid then return True from Query and allow the user to log in.

Member Avatar for mani-hellboy

---sorry previously posted also same i unfortunately did n`t saw that---

select record from database that have the same value as username and pwd if it returns record user authenticated else invalid user

Edited by mani-hellboy because: correction
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.