How to Encrypt a Password and Save it in SQL Server Database

Question

In my Project the User after the login has to Change the default Password when he logs in and that password will be stored in the Database I want to Encrypt the Password entered by the User in the Change Password Page and store it in the Database and during re-login of that User I want to Encrypt the password entered in the Login page and Check with the Saved password in Database or Fetch the Encrypted password for Decryption and Checking the Decrypted password with the Entered Password how can I do it my Change Password Code is,

SqlConnection con = new SqlConnection(@"Data Source=ESLHPC17\SQL2008;Initial Catalog=Eval;User ID=;Password=");
try
{
    string Qry = "Select Password from passtable where Password='" + CurrentPassword.Text + "'";
    string qry = "Select Password from passtable";
    SqlCommand cmd = new SqlCommand(Qry, con);
    SqlCommand cmd1 = new SqlCommand(qry, con);
    con.Open();
    SqlDataAdapter da = new SqlDataAdapter(cmd);
    SqlDataAdapter daa = new SqlDataAdapter(cmd1);
    DataTable dt = new DataTable();
    DataTable dtt = new DataTable();
    da.Fill(dt);
    daa.Fill(dtt);
    if (dtt.Rows[0]["Password"].ToString() == CurrentPassword.Text)
    {
        string strqry = "Update Passtable Set Password='" + EncryptString(NewPassword.Text) + "'";
        SqlCommand comd = new SqlCommand(strqry, con);
        comd.ExecuteNonQuery();
        Label1.Visible = true;
        Button1.Visible = true;
        ChangeButton.Enabled = false;
    }
    else
    {
        lblMessage.Visible = true;
        lblMessage.ForeColor = System.Drawing.Color.Red;
        lblMessage.Text = "Current Password and Entered Password did not Match !!!";
    }
}
finally
{
  con.Close();
  con.Dispose();
}

The Edited Code with SQL INJECTION detection

using (SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["EvalCon"].ConnectionString)) 
{
    try
    {
        string Qry = "Select Password from passtable where Password='" + CurrentPassword.Text + "'";
        string qry = "Select Password from passtable";
        if (CurrentPassword.Text != "Select" && CurrentPassword.Text != "Create Table" && CurrentPassword.Text != "Update" && CurrentPassword.Text != "Delete" && CurrentPassword.Text != "Truncate" && CurrentPassword.Text != "Drop Table" && CurrentPassword.Text != "Insert" && CurrentPassword.Text != "@")
        {
            if (NewPassword.Text != "Select" && NewPassword.Text != "Create Table" && NewPassword.Text != "Update" && NewPassword.Text != "Delete" && NewPassword.Text != "Truncate" && NewPassword.Text != "Drop Table" && NewPassword.Text != "Insert" && NewPassword.Text != "@")
            {
                using (SqlCommand cmd = new SqlCommand(Qry, con))
                {
                    using (SqlCommand cmd1 = new SqlCommand(qry, con))
                    {
                        con.Open();
                        SqlDataAdapter da = new SqlDataAdapter(cmd);
                        SqlDataAdapter daa = new SqlDataAdapter(cmd1);
                        DataTable dt = new DataTable();
                        DataTable dtt = new DataTable();
                        da.Fill(dt);
                        daa.Fill(dtt);
                        if (dtt.Rows[0]["Password"].ToString() == CurrentPassword.Text)
                        {
                            string strqry = "Update Passtable Set Password='" + NewPassword.Text + "'";
                            SqlCommand comd = new SqlCommand(strqry, con);
                            comd.ExecuteScalar()

                            Label1.Visible = true;
                            Button1.Visible = true;
                            ChangeButton.Enabled = false;
                        }
                        else
                        {
                            lblMessage.Visible = true;
                            lblMessage.ForeColor = System.Drawing.Color.Red;
                            lblMessage.Text = "Current Password and Entered Password did not Match !!!";
                        }
                    }
                }
            }
            else
            {
                lblMessage.Visible = true;
                lblMessage.ForeColor = System.Drawing.Color.Red;
                lblMessage.Text = "SQL INJECTION Breach you Can't Continue!!!";
                CurrentPassword.Enabled = false;
                NewPassword.Enabled = false;
                ConfirmNewPassword.Enabled = false;
            }
        }
        else
        {
            lblMessage.Visible = true;
            lblMessage.ForeColor = System.Drawing.Color.Red;
            lblMessage.Text = "SQL INJECTION Breach you Can't Continue!!!";
            CurrentPassword.Enabled = false;
            NewPassword.Enabled = false;
            ConfirmNewPassword.Enabled = false;
        }
    }
    finally
    {
        con.Close();
        con.Dispose();
    }
}

Remus Rusanu · Accepted Answer · 2013-05-09 09:22:19Z

3

Never use user input to append to SQL text. Your code is vulnerable to SQL injection. Use parameters. Read SQL Injection right now.

Do not store passwords in the database, even encrypted. Store a salted hash. Storing the encrypted password is an illusion of security because you will get the key management needed to decrypt the password wrong. You also talk about comparing the encrypted password which is, again, wrong, it means you do not know how to properly use a random IV in the encryption.
Learn to use using() {...} blocks
Learn to use appsetings/websettings for connection strings.
Learn to use ExecuteScalar

answered May 9, 2013 at 9:22

Remus Rusanu

296k42 gold badges459 silver badges583 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Rajesh Over a year ago

As per Your Advice I have made Changes for Checking the SQL INJECTION and used the Using() {....} blocks and used ExcecuteScalar and posted the edited code but I cant understand the Salted Hash in the Link you have given can you Help me out....

Feby · Accepted Answer · 2016-01-20 09:42:20Z

0

You can simplify the checking of SQLSyntax check with a class that you call when you want to check Text.

class SQLSyntaxCheck
{
    internal static bool CheckSyntax ( string Text )
    {
        if (Text != "Select" && Text != "Create Table" && Text != "Update" && Text != "Delete" && Text != "Truncate" && Text != "Drop Table" && Text != "Insert" && Text != "@")
            return true;
        else return false;

    }}

You can call it via SQLSyntaxCheck.CheckSyntax ( textbox1.Text.ToString() ) or whichever method comes your way.

answered Jan 20, 2016 at 9:42

Feby

1

Collectives™ on Stack Overflow

How to Encrypt a Password and Save it in SQL Server Database

2 Answers 2

Never use user input to append to SQL text. Your code is vulnerable to SQL injection. Use parameters. Read SQL Injection right now.

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Never use user input to append to SQL text. Your code is vulnerable to SQL injection. Use parameters. Read SQL Injection right now.

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related