Visual Basic

Encrypting passwords in a database

23-May-07 9:44

No, you Import System.Text, not System.Text.StringBuilder.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007

steve_rm23-May-07 5:42

steve_rm

23-May-07 5:42

Hello,

I am creating an application using vb and SQL 2005.

I have a table of users, that contain there usernames and passwords. When a new user is added it stores all the passwords in clear text in the database.

What is the best method to use to be able to crypt the passwords in the database.

Also, when the user login, i have a sql statement that will compare the username and password that they enter in the login dialog box, to what is in the database. If the password is encryted, would I still be able to compare their password to see if they can still login.

i.e.

<br />
"Select * From Users Where LoginID=@LoginID And Password=@Password"<br />

Many thanks for any suggestions,

Steve

Tarakeshwar Reddy23-May-07 6:03

Tarakeshwar Reddy

23-May-07 6:03

Take a look at
1) SQL Encrypt Decryption article[^]
2) VB NET TripleDES article[^]
3) System.Security.Cryptography [^] class.

You could encrypt your password using md5 and store it in the database. When the user log's on encrypt the password to md5 and compare it with the password in the database.

andyharman23-May-07 6:14

andyharman

23-May-07 6:14

Hi Steve

You could use the SQL-Server HashBytes function with the SHA1 algorithm to store a hash of the concatenated user-id and password strings. Your code for authenticating a user would then be:

select * from Users
where LoginID = @LoginID
and HashedPassword = HashBytes('SHA1', @LoginID + @Password)

The reason for not hashing just the password is that some-one with database access should not be able to see that two people have the same password - adding the user Id ensures that the hash value would be different.

Regards
Andy

Dave Kreskowiak23-May-07 6:27

23-May-07 6:27

MD5 is proven weak.

A better method would be to salt the password, encrypt it with your favorite (stronger) algorithm to get a hash of the salted password, then store the hash and the salt in the database.

When you go to check the users password, retrieve the password hash AND the salt, salt the entered password, run it through the same encryption algorithm you used to encrypt the original password to get it's hash, then compare to the two hashes.

There's examples of this all over the web. Just Google for "VB.NET password salt encrypt database". I highly recommend reading this[^] article on CP too.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007

Counting Records added and modified in a DataSet

kubben23-May-07 7:00

kubben

23-May-07 7:00

Make sure you turn case sensitivity on for the columns you are encrypting. I had a nasty little bug once because of that.

Ben

Quecumber25623-May-07 5:20

Quecumber256

23-May-07 5:20

Hi Everyone:
Cleako showed me a link where I can return records that were either added to or modified in a DataSet.

What I would like to do is show the user a message giving them the number of records that where added to the dataset and a number of existing records that where modified before they commit update to the database.

I didn't see anything like - MyDataSet.GetChanges(DataRowState.Modified.Count) or MyDataSet.GetChanges(DataRowState.Added.Count) which would make sense but isn't in the DataRowState class.

Anyone have an idea on how to accomplish this?

Thanks,

Quecumber256

Re: Counting Records added and modified in a DataSet

Dave Kreskowiak23-May-07 6:19

Re: Counting Records added and modified in a DataSet

23-May-07 6:19

The answer is staring you in the face. What does DataSet.GetChanges() return?? Another DataSet object! A DataSet is a collection of DataTables, which is a collection of DataRow objects. You can get the number of tables in this new DataSet quite easily:

Dim changes As DataSet = MyDataSet.GetChanges(DataRowState.Modified)
If changes IsNot Nothing AndAlso Not changes.HasErrors Then
    ' Get the number of tables in this changed dataset.
    Dim numTablesChanged As Integer = changes.Tables.Count

    ' Enumerate through these tables and add up the number of rows in each.
    Dim numTotalRecordChanges As Integer
    For Each t As DataTable In changes.Tables
        numTotalRecordChanges += t.Rows.Count
    Next
End If

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007

Quecumber25623-May-07 6:51

Quecumber256

23-May-07 6:51

Dave:
If I read your example right you are sending the DataSet of only those records that where modified? So your example will show the total number of records in the dataset that where modified(changed)?

FYI - I'm so wet behind the ears in Visual Studio .NET there is a good chance I will drown Smile | :)

.

Thank you,

Quecumber256

Re: Counting Records added and modified in a DataSet

Dave Kreskowiak23-May-07 6:55

pull data from access database table to vb.net

23-May-07 6:55

All you have to do is read the documentation on DataSet.GetChanges()[^].

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007

jds120723-May-07 3:56

jds1207

23-May-07 3:56

I have two functions. The first function search the directory for specific file extensions. I have a folder browser to browse to the folder in which I want to search for the files. The path is displayed into textbox1. Whatever file extension I type into textbox2, the filename with that extension will be added to listbox1.

Here is the code:

Private Sub GetDirectoryContents(ByVal dirs() As String, ByVal patterns() As String)<br />
        'Declare variable.<br />
        Dim dDir As DirectoryInfo<br />
<br />
        For Each sDir As String In dirs<br />
            If Not Directory.Exists(sDir) Then Continue For<br />
            dDir = New DirectoryInfo(sDir)<br />
            For Each ext As String In patterns<br />
                For Each fi As FileInfo In dDir.GetFileSystemInfos("*." & ext)<br />
                    ListBox1.Items.Add(fi.Name)<br />
                Next<br />
            Next<br />
        Next<br />
      End Sub

The second function connects to an access database pulling data from tblExclude. The table has three fields(ExcludeID, ExcludeFilePath, ExcludeFileName). The code that I have will read the data in tblExclude and display the columns rows into listbox2.

Here is the code:

Private Sub SearchDatabase()<br />
<br />
        Dim myConnString As String = "Provider=Microsoft.Jet.OleDB.4.0;Data Source=" & Application.StartupPath & "\File.mdb"<br />
        Dim myConnection As New OleDbConnection(myConnString)<br />
        myConnection.Open()<br />
        Dim strSQL As String = "SELECT ExcludeFileName FROM tblExclude"<br />
        Dim cmd As OleDbCommand = New OleDbCommand(strSQL, myConnection)<br />
        Dim objread As OleDbDataReader<br />
        objread = cmd.ExecuteReader<br />
<br />
        While objread.Read<br />
            Me.ListBox2.Items.Add(objread("ExcludeFileName") & "")<br />
        End While<br />
        objread.Close()<br />
        myConnection.Close()<br />
<br />
        Me.ListBox2.SelectedIndex = 0<br />
      End Sub

I need these two functions to some how interact with each other to get it to do what I want it to do. I want to be able to check the db table to see if a specific file exist. If the ExcludeFilePath in tblExclude is equal to the file path in textbox1 then display ExcludeFileName from tblExclude into listbox2. If the ExcludeFilePath in tblExclude does not equal the path in textbox1 then perform the first function. I know that this may be a lot of information but I want to make sure it is comprehendible.

jds1207

Re: pull data from access database table to vb.net

Dave Kreskowiak23-May-07 6:43

Using the character '&' in Label.Text

23-May-07 6:43

All you have to do is check each file against your database using a little SQL:

SELECT Count(ExcludeFileName) FROM tblExclude WHERE ExcludeFileName LIKE ?Filename

Use the normal OldDbCommand object to execute this query, using it's ExecuteScalar method. Make sure you give the filename in an OleDbParameter object! If you get back anything over 0, that filename is in the database.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007

RichFeldman23-May-07 3:44

RichFeldman

23-May-07 3:44

I would like to use an ampersand (&) within a string in a text for a label. I guess because it is used to underline characters in menus, the '&' does not appear in the label. Any ideas on how to display something like "A&M" for the text of a label?

Rich Feldman

Re: Using the character '&' in Label.Text

Kschuler23-May-07 4:10

Kschuler

23-May-07 4:10

I'm not sure if it works in VS 2003, but in VS 2005 you would just do this:

myLabel.Text = "A&&M"

how do u communicate btn a webserver and a remote computer via the internet?

dleo1023-May-07 3:22

dleo10

23-May-07 3:22

i am currently to develope a project(part of a school assignment) that should establish communication between a webserver and a remote computer. its should work like a standard server/client tcp LAN project.

i tried using tcpClient and tcpListener i.e

'------------------------------
Dim client As TcpClient
client = New TcpClient("www.myproject.com", 13000)

Dim server As TcpListener
server = New TcpListener System.Net.IPAddress.Any,13000)
'------------------------------

but this did not work. Please, is there anyone there who can help me. thanks in advance

leo1

Re: how do u communicate btn a webserver and a remote computer via the internet?

Dave Herren23-May-07 3:36

Dave Herren

23-May-07 3:36

I googled vb.net Sockets[^] and got the following article: VB.NET TCP Client/Server Socket Commmunications[^] and it's code looked a bit different than yours.

Samples in articles like this usually work, but there were several other articles out there so do some more reading if need be.

topcoderjax - Remember, Google is your friend.

MS Outlook macro help...

Fred_Smith23-May-07 2:18

Fred_Smith

23-May-07 2:18

This isn't VB so much as VBA, I guess, but maybe someone can help...

MS Outlook allows you to open a message and remove any attachments (right-click and select "Remove") - the trouble is that having done so there is no record left of it... I wanted a way to insert a line ssayting "attachment xyz.doc removed", or something.

I came up with a little macro to do this, below, but it has a side-effect of also removing all and any formatting in the email body as well, which is somehwta unfortunate.

If anyone can help with how to re-write this to
a) ermove the attachment(s)
b) insert/append line(s) saying what has been removed
c) retain the original formatting (html) of the message

I would be most grateful...

cheers
Fred

Sub delAttach()
Dim i%, k%, km%, v$

On Error Resume Next

With ActiveExplorer.Selection
For i = 1 To .Count
' Debug.Print i, .Item(i).Subject, .Item(i).Attachments.Count

Err.Clear
km = .Item(i).Attachments.Count
If km > 0 Then
v = Format$(km)
k = 1
.Item(i).Body = .Item(i).Body & vbCrLf & vbCrLf & "--- " & km & " Attachment(s) removed " & _
Now & " -------------------------" & vbCrLf

Do While k <= km
.Item(i).Body = .Item(i).Body & vbCrLf & .Item(i).Attachments(k).FileName
k = k + 1
Loop

Do While k > 1
k = k - 1
.Item(i).Attachments(k).Delete
Loop

.Item(i).Body = .Item(i).Body & vbCrLf & "---------------------------------"

.Item(i).UserProperties.Add "AttachRmvd", olText
.Item(i).UserProperties("AttachRmvd") = v
If Err = 0 Then .Item(i).Save

End If

Next i
End With

End Sub

Dave Kreskowiak23-May-07 6:01

23-May-07 6:01

I don't do Office Interop, but it looks like your adding this text to the message with regard as to the type of text that's in the message, like Plain, RichText or HTML. I think you'd have to figure out what type of text it is first, then insert the text based on the rules of formatting for that type. For instance, if it's an HTML message, you'd have to find the <body> tags and insert the text inside those tags.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007

Fred_Smith23-May-07 6:19

Fred_Smith

23-May-07 6:19

Ta - no doubt you're right... but that's where I get stuck!
cheers
Fred

Dave Kreskowiak23-May-07 6:33

23-May-07 6:33

What you mean you get stuck? It's simple string manipluations. Look for an <HTML> tag, then if you find one, look for a <BODY> tag. If you've found both, then you possibly have a valid HTML mail. Find the corresponding </BODY> tag and you've no doubt found the place to strick your message.

If not, test for RichText using similar methods, but different search criteria.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007