使用salt进行散列后，C＃，asp.net密码不匹配

Question

I have used hashing with salt for password.Before i implemented hashing, i had a stored procedure which used to check textbox value with the value in Database and the code was working fine .After implementing hashing though the passwords are not matching,i checked the hashed value in database and password that i entered and both are same.I looked up in google and some suggested that manually entering value in Database for password will cause an issue.So i created a user registration form and hashed the password there and stored it in the database.Can anyone please guide me as to where i am going wrong.

My loginpagecode:

 using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    using System.Web.UI;
    using System.Web.UI.WebControls;
    using System.Configuration;
    using System.Data.SqlClient;
    using System.Data;
    using System.Security.Cryptography;

    namespace taxiservices
    {
        public partial class adminlogin : System.Web.UI.Page
        {
            String Salt;
            String Hash;
            String Pwd;
            protected void Page_Load(object sender, EventArgs e)
            {

            }

            public string SaltedHash(string password)
            {
                Salt = "salthashtestsalthashtestsalthashtestsalthashtestsalthashtestsalthashtestsalthashtestsalthashtest";
                Hash = ComputeHash(Salt, password);
                return Hash;

            }

            static string ComputeHash(string salt, string password)
            {
                var saltBytes = Convert.FromBase64String(salt);
                using (var rfc2898DeriveBytes = new Rfc2898DeriveBytes(password, saltBytes, 1000))
                    return Convert.ToBase64String(rfc2898DeriveBytes.GetBytes(256));
            }

            public static bool Verify(string salt, string hash, string password)
            {
                return hash == ComputeHash(salt, password);
            }

            protected void Button1_Click(object sender, EventArgs e)
            {
                Session["username"] = username.Text.ToString();
                 Pwd=SaltedHash(password.Text.ToString());
                 Response.Write(Pwd);
                string query;
                string ConnectionStringnew = ConfigurationManager.ConnectionStrings["ConnectionStringName"].ConnectionString;
                using (SqlConnection con = new SqlConnection(ConnectionStringnew))
                {
                    query = "Emplogin";   //stored procedure Name
                    SqlCommand com = new SqlCommand(query, con);
                    com.CommandType = CommandType.StoredProcedure;
                    com.Parameters.AddWithValue("@Usename", username.Text.ToString());   //for username 
                    com.Parameters.AddWithValue("@Password",Pwd);  //for password

                    con.Open();

                    int usercount = (Int32)com.ExecuteScalar();// for taking single value
                    con.Close();
                    if (usercount == 1)  // comparing users from table 
                    {

                        Session["user"] = "valid";

                        Response.Redirect("adminhomepage.aspx");  //for sucsseful login
                    }
                    else
                    {

                        Label2.Text = "Invalid User Name or Password";  //for invalid login
                    }



                }
            }

            protected void username_TextChanged(object sender, EventArgs e)
            {

            }
        }
    }

Page where user creates a password:

 using System;
    using System.Collections.Generic;
    using System.Configuration;
    using System.Data.SqlClient;
    using System.Linq;
    using System.Security.Cryptography;
    using System.Web;
    using System.Web.UI;
    using System.Web.UI.WebControls;

namespace taxiservices
{
    public partial class changepassword : System.Web.UI.Page
    {
        String Salt;
        String Hash;
        protected void Page_Load(object sender, EventArgs e)
        {


        }

        protected void TextBox2_TextChanged(object sender, EventArgs e)
        {

        }
        public string SaltedHash(string password)
        {
            Salt="salthashtestsalthashtestsalthashtestsalthashtestsalthashtestsalthashtestsalthashtestsalthashtest";
            Hash = ComputeHash(Salt, password);
            return Hash;
        }

        static string ComputeHash(string salt, string password)
        {
            var saltBytes = Convert.FromBase64String(salt);
            using (var rfc2898DeriveBytes = new Rfc2898DeriveBytes(password, saltBytes, 1000))
                return Convert.ToBase64String(rfc2898DeriveBytes.GetBytes(256));
        }

        protected void Button1_Click(object sender, EventArgs e)
        {

            string Pwd = SaltedHash(TextBox2.Text);
            string ConnectionStringn = ConfigurationManager.ConnectionStrings["ConnectionStringName"].ConnectionString;
            using (SqlConnection con = new SqlConnection(ConnectionStringn))
            {
                using (SqlCommand cmd = new SqlCommand("INSERT INTO Users(Username,Password) VALUES(@User,@password)"))
                {
                    cmd.Connection = con;
                    cmd.Parameters.AddWithValue("@User", TextBox3.Text);
                    cmd.Parameters.AddWithValue("@password", Pwd);
                    con.Open();
                    cmd.ExecuteNonQuery();
                    con.Close();

                }
            }
        }
    }
}

The Stored Procedure:

    Create  procedure Emplogin
(
@Usename Varchar (20),
@Password varchar (10)
)
as
Begin
Select COUNT(*)from Users where username=@Usename and password=@Password 
End

Answer 1

When you pass the details into you Emplogin stored procedure, it is only getting the first 10 characters of your salted password (it truncates away the other 246). When it checks this ten-character string against your Users database, it doesn't find a match.

You should adjust your Emplogin procedure so that the length of the @Password variable matches that of the password column in your Users table.