在存储过程中验证用户

Question

I am new to sql and I am not sure what's wrong with my stored procedure.

User inputs user name & password which are my input parameters and if it is correct then return 'Login Success', if UN is incorrect than return 'Incorrect UN' or if PW is incorrect than return 'Incorrect PW'. In the stored procedure I have an IF Else statement and it is only hitting the first IF statement not other.

Please have a look my stored procedure:

CREATE PROCEDURE [dbo].[AuthenticateUser]
@UserName varchar(15),
@Password varchar(15),
@Role varchar(25) OUTPUT
AS
    SET NOCOUNT ON
BEGIN
    DECLARE @UN VARCHAR(25)
    DECLARE @PW VARCHAR(25)
    SELECT @UN = UserName, @PW = Password FROM LogIn 
        IF (@UN != @UserName COLLATE SQL_Latin1_General_CP1_CS_AS)
            BEGIN
                SET @Role = 'Incorrect User Name'
            END
        ELSE
            BEGIN
                IF (@PW != @Password COLLATE SQL_Latin1_General_CP1_CS_AS)
                    BEGIN
                        SET @Role = 'Incorrect Password'
                    END
                ELSE
                    BEGIN
                        SET @Role = 'Logged in Successfully'
                    END
            END
    SELECT @Role
END

Thank you for your help

Answer 1

Change it to a SELECT COUNT(1) FROM userLogin.... and then use ExecuteScalar() on the SqlDataReader object.

As a side note, it's not a good idea to store your passwords in the DB in plain text, but hash them instead, preferably with a salt value.

Answer 2

You are doing this:

SELECT @UN = UserName, @PW = Password FROM LogIn 
    IF (@UN != @UserName COLLATE SQL_Latin1_General_CP1_CS_AS)

These comparisions @UN = UserName and @PW = Password should be made in the WHERE clause to help in proper filtering of rows.

Here is the code rewritten (you can change to using your own table name)

Drop Table TestLogin 
GO
Create Table TestLogin 
(
UserName VarChar (20),
Password VarChar(20)
)
Insert TestLogin Values ('One', 'Two')
GO




Drop PROCEDURE AuthenticateUser
GO
CREATE PROCEDURE AuthenticateUser
    @UserName varchar(15),
    @Password varchar(15),
    @Role varchar(25) OUTPUT
AS

    If ((SELECT Count (*) From TestLogin Where UserName COLLATE SQL_Latin1_General_CP1_CS_AS = @Username And Password COLLATE SQL_Latin1_General_CP1_CS_AS = @Password) = 0)
    Begin
        If ((SELECT Count (*) From TestLogin Where UserName COLLATE SQL_Latin1_General_CP1_CS_AS = @Username) = 0)
        Begin
            Select @Role = 'Incorrect User Name'
        End
        Else
        Begin
             Select @Role = 'Incorrect Password'
        End
    End
    Else
    Begin
        Select @Role = 'Logged in Successfully'
    End
GO
Declare @Role VarChar (100)
Exec AuthenticateUser 'One', 'Two', @Role Output
Print @Role

Exec AuthenticateUser 'One', 'TwoX', @Role Output
Print @Role

Exec AuthenticateUser 'OneX', 'Two', @Role Output
Print @Role

The three examples provided at the end show you how the procedure behaves when you give it a good login, or either parameter is incorrect.

Answer 3

Try this instead:

Create PROCEDURE [dbo].[AuthenticateUser]
@UserName varchar(15),
@Password varchar(15),
@Role varchar(25) OUTPUT
AS
    SET NOCOUNT ON
BEGIN

    If Not Exists (Select 1 From LogIn Where UserName = @UserName) Set @Role = 'Incorrect UserName'
    Else If Not Exists (Select 1 From LogIn Where Password = @Password) Set @Role = 'Incorrect Password'
    Else Set @Role = 'Logged in Successfully' 

    Select @Role

END

Answer 4

Generally it is not good idea to give an attacker a cue "name is OK, now guess PWD". Plus, password should be at least case sensitive. For this purpose:

select @un=username from LogIn 
where username=@username 
and cast(password as varbinary(max)) = cast(@password as varbinary(max))

if @un is null
   set @role = 'UN or PWD is incorrect'
else
   set @role = 'Success'

If you want to give hints:

select @un=username from LogIn 
where username=@username 

if @un is null
   set @role = 'UN not found'
else
begin
   select @un=username from LogIn 
   where username=@username 
   and cast(password as varbinary(max)) = cast(@password as varbinary(max))
   if @un is null
      set @role = 'password incorrect'
   else
      set @role = 'Success'
end

PS: I hope username is unique in your table.