Click here to Skip to main content
15,891,033 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
I already have a Log-in form whose code I have shown below and I only want to know that how to save the password in ENCRYPTED form in sqlserver 2008.
C#
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data.SqlClient;

namespace WindowsFormsApplication24
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        string msg;
        SqlConnection con = new SqlConnection("Data Source=ITC-002;Initial Catalog=Tempabc;User ID=sa;Password=********");
        SqlCommand cmd;
        DataSet ds = new DataSet();

        private void btn_login_Click(object sender, EventArgs e)
        {
            try
            {
                if (txtbx_name.Text == "" || txtbox_password.Text == "")
                {
                    MessageBox.Show(" Enter UserName and Password .");
                    return;
                }

                cmd = new SqlCommand("SELECT * FROM LoginDetails where Name='" + txtbx_name.Text + "' and Password='" + txtbox_password.Text + "'", con);
                SqlDataAdapter da = new SqlDataAdapter(cmd);
                da.Fill(ds);
                int i = ds.Tables[0].Rows.Count;
                if (i == 1)
                {
                    msg = "Welcome " + txtbx_name.Text;
                    this.Hide();
                    Form2 f2 = new Form2(msg);
                    f2.Show();
                    ds.Clear();

                }
                else
                {
                    MessageBox.Show("Not Registered User or Invalid Name/Password");
                    txtbox_password.Text = "";
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);
            }

        }

        private void btn_register_Click(object sender, EventArgs e)
        {
            try
            {

                if (txtbx_name.Text == "" || txtbox_password.Text == "")
                {
                    MessageBox.Show(" Enter UserName and Password .");
                    return;
                }

                /** checking whether name exists **/
                cmd = new SqlCommand("SELECT * FROM LoginDETAILS where Name='" + txtbx_name.Text + "'", con);
                SqlDataAdapter da = new SqlDataAdapter(cmd);
                da.Fill(ds); //filling dataset
                int i = ds.Tables[0].Rows.Count; //checking rows count in dataset
                if (i > 0)
                {
                    MessageBox.Show("UserName " + txtbx_name.Text + " Already Exists..");
                    txtbox_password.Text = "";
                    ds.Clear(); //clearing dataset
                }
                else
                {
                    /** inserting name and password in table logindetails **/
                    cmd = new SqlCommand("INSERT INTO LOGINDETAILS VALUES('" + txtbx_name.Text + "','" + txtbox_password.Text + "')", con);
                    con.Open();
                    cmd.ExecuteNonQuery();
                    con.Close();

                    msg = "Registered Successfully \n Welcome " + txtbx_name.Text;
                    this.Hide(); //hiding form1
                    Form2 f2 = new Form2(msg);
                    f2.Show(); //showing form2 

                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);
                con.Close();
            }

        }
    
    
    
    }
}
Posted
Updated 30-Sep-13 23:42pm
v4
Comments
Rob Philpott 1-Oct-13 5:42am    
Encrypted? Normally you'd store it as hashed. Is this what you want?
alanmaster 1-Oct-13 5:45am    
Yes, you are correct.
alanmaster 1-Oct-13 5:46am    
I have heard of using RSA algorithm but i don't know how to use it.
Rob Philpott 1-Oct-13 7:26am    
People normally use SHA1 (which is in the Cryptography namespace of .NET). You need to read up on this though and know the dangers. You should consider 'salting' the hash if security is important to you.

1 solution

First of all,you should not store password at all in either form. You should always create hash of the password and store it. The generated result can't be reverted back to its normal form. So at the time of login,you should compare hash to hash, not password to password.

See below links for better understanding.

Password Storage: How to do it.[^]

Beginners guide to a secure way of storing passwords[^]
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900