ASP.NET

sneha Choudhary wrote:

. Is there any chance that when the username and passwords

N a v a n e e t h wrote:

Are you storing the password as plain text in DB?

sneha Choudhary wrote:

Should I encrypt it

N a v a n e e t h wrote:

Hash it. Passwords stored as plain text is not secure. Better method is to hash the password and store the computed hash in database. When user enters password for authentication, has it and compare the hash with the value stored in DB. System.Security.Cryptography[^] got many classes to work with. Check SHA[^] implementation.

protected void Button1_Click(object sender, EventArgs e)
{
    string pwd = Txtpassword.Text.Trim();
    string hashpwd = FormsAuthentication.HashPasswordForStoringInConfigFile(pwd, "SHA1");
    //SqlConnection con = new SqlConnection("Server=.; Database=eclsc; Trusted_Connection=yes");
    SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["newcon"].ConnectionString);
    SqlCommand cmd = new SqlCommand();
    cmd.Connection = con;
    cmd.CommandText = "Select userid,username,password,first_name from USERS where username=@username and password=@password";

    cmd.Parameters.Add("@username", SqlDbType.NVarChar, 50).Value = Txtusername.Text.Trim();
    cmd.Parameters.Add("@password", SqlDbType.NVarChar, 50).Value = hashpwd;

    try
    {
        cmd.Connection.Open();
        SqlDataReader rdr = cmd.ExecuteReader();
        while(rdr.Read())
        {
            //string x = (rdr["password"]).ToString();
            uid = (rdr["userid"]).ToString();
            fname = (rdr["first_name"]).ToString();
            uname = (rdr["username"]).ToString();
            Session["uname"] = uname;
            Session["userid"] = uid;
            if (uname != null)
            {
                //Change the Session called "Logged" value into "Yes"
                Session["Logged"] = "Yes";

                //Store the Username in one of the Sessions, so it can be used later
                Session["User"] = fname;

                //Redirect to the requested page
                //If there is no requested page, then it will be redirected to the Default.aspx WebForm
                Label6.Text = (Session["URL"]).ToString();
                Response.Redirect(Label6.Text);
            }
            else
            {

            }
        }
    }
    catch (SqlException se)
    {
        Lblmsg.Text = se.Message;
    }
    catch (Exception ee)
    {
        Lblmsg.Text = ee.Message;
    }
    finally
    {
        cmd.Connection.Close();
    }
}

anilpal wrote:

Is your server is local for application or remote.

anilpal wrote:

Tommarrow i'll let know the pros and cons abt code and sql encryption.
Now i have to go home.

N a v a n e e t h wrote:

Better method is to hash the password and store the computed hash in database.