c# - 使用 md5 将密码保存为二进制文件并将其与数据库进行比较

Question

在 ASP.NET 应用程序中，我使用 md5 将密码作为“二进制”数据保存到数据库中。

我现在如何比较密码？

我使用了 code in this article to encrypt the password with md5

代码有效。当用户在登录时输入密码时，如何比较密码？检查密码是否与数据库中的加密密码匹配的代码是什么。

我使用了下面的代码，但它总是显示“不正确的用户名或密码”，即使它是正确的。“修改后的代码”

Byte[] hashedBytes;
    string Password = txtPassword.Text;
    MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
    UTF8Encoding encoder = new UTF8Encoding();

    hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(Password));
    Byte[] pass = new Byte[16];
    SqlConnection conn = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");

    SqlCommand cmd = new SqlCommand("SELECT * FROM Users WHERE UserName=@UserName", conn);
    cmd.Parameters.AddWithValue("@UserName", txtUserName.Text);
    conn.Open();
    SqlDataReader rdr = cmd.ExecuteReader();
    if (rdr.Read())
        pass = (Byte[])rdr["password"];

    foreach (Byte b in pass)
    {
        Label1.Text += b.ToString() + " ";



        //Response.Write(b.ToString());

        string UserName = txtUserName.Text;
        bool isMatch = false;
        Byte[] password = new Byte[16];

        SqlConnection con = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
        con.Open();

        SqlCommand cmdd = new SqlCommand(string.Format("select * from Users where UserName='{0}'", UserName), con);
        cmd.CommandType = CommandType.Text;
        cmd.Parameters.AddWithValue("@UserName", txtUserName.Text);
        SqlDataReader dr = cmdd.ExecuteReader();
        if (dr.Read())
        {
            password = (Byte[])dr["Password"];
        }
        foreach (Byte c in password)
        {
            Label2.Text += c.ToString() + " ";//I didnt close the pracket fo that reason data is repeted if I close it I cant type c.toString



            while (dr.Read())
            {

                if (b.ToString() == c.ToString()) // I mean this statment
                {
                    isMatch = true;
                }
            }
        }




        dr.Close();
        con.Close();

        if (isMatch)
        {
            Response.Write("correct");
        }
        else
        {
            Response.Write("Incorrect username or password!");
        }

    }

修改后的代码protected void Button1_Click(object sender, EventArgs e) { } public static bool ValidateUser(字符串用户名，字符串密码) { SqlConnection con = new SqlConnection("数据源=shihab-PC;初始目录=test;用户ID=sh;密码=admin"); con.Open();

    using (var connection = new SqlConnection("connectionString"))
    using (var command = connection.CreateCommand())
    {
        command.CommandText = "SELECT dbo.checkUserExists (@userName, @password)";
        command.Parameters.Add("@userName", SqlDbType.NVarChar, 25).Value = userName;
        command.Parameters.Add("@password", SqlDbType.NVarChar).Value = GenerateHash(password);

        connection.Open();
        return (bool)command.ExecuteScalar();
    }
}

private static string GenerateHash(string value)
{
    return Convert.ToBase64String(new System.Security.Cryptography.HMACSHA1(Encoding.UTF8.GetBytes("salt")).ComputeHash(Encoding.UTF8.GetBytes(value)));
}

Answer 1

当您比较密码时 - 您需要计算他们提交的密码的 MD5。

所以在你的代码中你想要这样的东西:

MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
//create an array of bytes we will use to store the encrypted password
Byte[] hashedBytes;
//Create a UTF8Encoding object we will use to convert our password string to a byte array
UTF8Encoding encoder = new UTF8Encoding();

//encrypt the password and store it in the hashedBytes byte array
hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(txtPassword.Text));

//set the password they are using now to password for the compare:
Password = hashedBytes;

之后，您可以运行您的比较代码。关键是数据库中的密码是你注册时计算的原始hashedBytes

编辑:这是您的原始代码:

SqlConnection con = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
con.Open();
string UserName = txtUserName.Text;
string Password = txtPassword.Text;

//hash password
MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
Byte[] hashedBytes;
UTF8Encoding encoder = new UTF8Encoding();
hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(Password));
Password = hashedBytes.ToString();

bool isMatch = false;
SqlCommand cmdd = new SqlCommand(string.Format("select * from Users where UserName='{0}'", UserName),con);
SqlDataReader dr = cmdd.ExecuteReader();
while (dr.Read())
{
    if (dr["password"].ToString()==Password)  
    {
        isMatch = true;
    }
}
dr.Close();
con.Close(); 
if (isMatch)
{
    Response.Write("correct");
}
else
{
    Response.Write("Incorrect username or password!");
}

更新了转换错误的代码

试试这段代码来查看密码这将打印出哈希密码和数据库中的密码——如果它们不匹配，你就会遇到问题(可能是盐问题)

Byte[] hashedBytes;
string Password = txtPassword.Text;
MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
UTF8Encoding encoder = new UTF8Encoding();
hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(Password));

Response.Write(string.Format("Hashed Password (Given): {0}<br />", hashedBytes.ToString()));

string UserName = txtUserName.Text;
SqlConnection con = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
con.Open();

SqlCommand cmdd = new SqlCommand(string.Format("select * from Users where UserName='{0}'", UserName),con);

SqlDataReader dr = cmdd.ExecuteReader();

//should be only one row..
while (dr.Read())
{
    Response.Write(string.Format("Hashed Password (DB): {0}", dr["password"].ToString()));
}
dr.Close();
con.Close();