通过 Visual Studio C# .NET 处理哈希函数插入 MySql 数据库

Question

I am working on a login system for a giant company with a hotel, restaurant and pool. Each Employee within this company will have access/+monitoring credentials to the system's DB.

I understand saving passwords in plain text is a BAD BAD approach so I managed the password hashing part tested it using text boxes and Message Boxes(which I removed later). and since almost everyone (or the post, videos and threads/forms I've read) said it is a must to have a HashFunction and a Salt Column in your database beside the HashedPassword Column; I am having some of a hard-time inserting the hash-function value into the HashFunction column for I don't know what is the value that holds it!

Here is the code I have

private MySqlConnection Connect()
    {
        string con = "Server = servername; DataBase=DBName; username= usr; password=pwd ; Persist Security Info = False; Charset =utf8";
        MySqlConnection connection = new MySqlConnection(con);
        connection.Open();
        return connection;
    }
    private String Salt(int size)
    {
        var rng = new System.Security.Cryptography.RNGCryptoServiceProvider();
        var buffsize = new byte[size];
        rng.GetBytes(buffsize);
        return Convert.ToBase64String(buffsize);
    }

    private String GenerateSHA256Hash(string In, string salt)
    {
        byte[] bytes = System.Text.Encoding.UTF8.GetBytes(In + salt);
        SHA256Managed sha256hashstring = new SHA256Managed();
        byte[] hash = sha256hashstring.ComputeHash(bytes);
        return Convert.ToBase64String(hash);
    }

    private void BtnAddUsr_Click(object sender, EventArgs e)
    {
        string salt = Salt(10);
        string hashedpswd = GenerateSHA256Hash(txtp.Text, salt);
        string AddUser = "Insert into users(name,password,hashfunc,salt,position) VALUES ('" + txtu.Text + "','" + txtp.Text + "','" + hashedpswd.ToString() + "',";
    }

This is the DB Structure in PHPMyAdmin:

How I can handle this and if by any chance anyone can help me with verifying if the user enters the right password, it would be great? Many Thanks.

Answer 1

Thanks to @Chetan I have managed to figure out where I messed up BIG TIME !!!

The code looks pretty much the same except for minor stupid changes in the command string

private String Salt(int size)
    {
        var rng = new System.Security.Cryptography.RNGCryptoServiceProvider();
        var buffsize = new byte[size];
        rng.GetBytes(buffsize);
        return Convert.ToBase64String(buffsize);
    }

    private String GenerateSHA256Hash(string In, string salt)
    {
        byte[] bytes = System.Text.Encoding.UTF8.GetBytes(In + salt);
        SHA256Managed sha256hashstring = new SHA256Managed();
        byte[] hash = sha256hashstring.ComputeHash(bytes);
        return Convert.ToBase64String(hash);
    }

    private void BtnAddUsr_Click(object sender, EventArgs e)
    {
        try
         {
            if (txtp.Text != "" && txtu.Text != "")
            {
                MySqlConnection con = Connect();
                string salt = Salt(10);
                string hashedpswd = GenerateSHA256Hash(txtp.Text, salt);
                string AddUser = "Insert into users(name,hashedfact,salt,position) VALUES (@username,@hashedpassword,@salt,@poz)";
                MySqlCommand mySqlCommand = new MySqlCommand(AddUser, con);
                mySqlCommand.Parameters.AddWithValue("@uname", txtu.Text);
                mySqlCommand.Parameters.AddWithValue("@hashedfact", hashedpswd);
                mySqlCommand.Parameters.AddWithValue("@sugar", salt);
                mySqlCommand.Parameters.AddWithValue("@poz", CmbPositions.SelectedItem.ToString());


                //'" + txtu.Text + "','" + hashedpswd.ToString() + "', '"+hashvalue.ToString()+"', " +
                //"'" + salt.ToString() + "','" + CmbPositions.SelectedItem.ToString() + "'
                int res = mySqlCommand.ExecuteNonQuery();
                if (res == 1)
                {
                    DialogResult dialog = MessageBox.Show("User Added Successfully,Would you like to sing-in?", "Proceed?", MessageBoxButtons.YesNo, MessageBoxIcon.Information);
                    if (dialog == DialogResult.Yes)
                    {
                        new Thread(() => new Form1().ShowDialog()).Start();
                        this.SendToBack();
                    }
                    else
                    {
                        Application.Exit();
                    }
                }
            }
         }
         catch (MySqlException ex)
         {
             if (txtp.Text == "" || txtu.Text == "")
             {
                 MessageBox.Show(ex.Message.ToString(), "Error Adding User", MessageBoxButtons.OK, MessageBoxIcon.Error);
             }
         }
         finally
         {
             Connect().Close();
         }
    }

And my Database looks better now!