mysql - vb.net 中登录表单的散列密码

Question

我有一个登录表单，我还没有对密码散列做任何事情，我一直在这里和那里阅读有关散列的内容，但它真的让我感到困惑并且真的不知道如何在我的登录表单代码中实现它。我看到的散列代码

Dim bytes() as byte  = System.Text.Encoding.UTF8.GetBytes(stringPassword);
dim  hashOfBytes() as byte = new System.Security.Cryptography.SHA1Managed().ComputeHash(bytes)
Dim strHash as string = Convert.ToBase64String(hashOfBytes)

转换回字节

hashOfBytes = Convert.FromBase64String(strHash)

** 我的登录表单代码**

Using conn As New MySqlConnection("Server = localhost; Username= root; Password =; Database = forms")
    Using cmd
        With cmd
            MsgBox("Connection Established")
            .Connection = conn
            .Parameters.Clear()
            .CommandText = "SELECT * FROM users WHERE BINARY Username = @iUsername AND Password = @iPassword"
            .Parameters.Add(New MySqlParameter("@iUsername", txtUser.Text))
            .Parameters.Add(New MySqlParameter("@iPassword", txtPass.Text))

        End With
        Try
            conn.Open()
            dr = cmd.ExecuteReader()
        Catch ex As MySqlException
            MsgBox(ex.Message.ToString())
        End Try
    End Using
End Using

If dr.HasRows = 0 Then

    MsgBox("Invalid user")
    Conn.Close()

Else


    Start.Show()
    Conn.Close()


End If
End Sub

Answer 1

您应该将密码的哈希值存储在表的密码字段中。
然后搜索用户和密码哈希，而不是直接搜索从输入框中获取的密码。

但是，您的代码仍然会失败，因为您在处理连接后尝试使用 MySqlDataReader。移动 Using block 内的行检查

 Dim strHash as string = Convert.ToBase64String(hashOfBytes)
 .....
 Dim userIsValid as Boolean = False
 Using conn As New MySqlConnection(.........)
 Using cmd
    ....
        .Parameters.Add(New MySqlParameter("@iPassword", strHashPass))
        Try
            conn.Open()
            dr = cmd.ExecuteReader()
            userIsValid = dr.HasRows
        Catch ex As MySqlException
            MsgBox(ex.Message.ToString())
        End Try
  End Using
  End Using

  if userIsValid then
      .....
  else
      .....
  End