asp.net database username and password check

Asked Jan 07 '17 at 14:08

Active Jan 07 '17 at 14:11

Viewed 610 times

I have added this code and get the count.

  string qry2 = "select count(*) from RegCustomer where username='"+TextBoxUN.Text+"' and password='"+TextBoxPW.Text+"'";

the password stored in the database is - apple

it will return 1 as the count if we type the correct username with this pw - apple

but when type password as this - Apple
it will also return 1. it does not check the password is in lower case or not.

I used varchar(50) for the password field in the SQL server.

asked Jan 07 '17 at 14:08

Senura Dissanayake

3

Vulnerabilities - SQL Injection, plaintext password. Now, do you have any row stored with "Apple" password too? – Gurwinder Singh Jan 07 '17 at 14:10
No there is not any row stored Apple as the pw. – Senura Dissanayake Jan 07 '17 at 14:11
Looks like you need to fix your approach in storing and validating the password rather than fixing the query – Pரதீப் Jan 07 '17 at 14:18
3

You should not be using this query altogether, nor build queries with input by string concatenation. Properly store your passwords (see for example [Best way to store password in database](http://stackoverflow.com/questions/1054022/best-way-to-store-password-in-database)) and use parameterized queries. Alternatively, outsource your authentication and authorization to a library specialized in that subject. – CodeCaster Jan 07 '17 at 14:18
@Prdp.. I have used the `COLLATE Latin1_General_CS_AS` . It worked..! – Senura Dissanayake Jan 07 '17 at 14:24
4

@Senura - No,... Just listen to what others are saying. Your approach is wrong it is open to sql injection – Pரதீப் Jan 07 '17 at 14:26
@GurV and CodeCaster, Thanks fro letting me knw the vulnerabilities.. !! I am doing this for a university project. I am still at the beginner level.So could you please suggest me a simple encryption method? – Senura Dissanayake Jan 07 '17 at 14:27
@Prdp, thanks could you please suggest me a simple encryption method?? – Senura Dissanayake Jan 07 '17 at 14:28
@Senura See the CodeCaster's suggestion – Gurwinder Singh Jan 07 '17 at 14:29
Thank you all for helping me out !! I will follow that.. ! – Senura Dissanayake Jan 07 '17 at 14:30

asp.net database username and password check

0 Answers0