如何将输入密码与数据库 hash 密码进行比较？

Question

. There are disputes about this question's content being resolved at this time. It is not currently accepting new answers or interactions.

I want to write an if that will log in to the admin panel if the user name and password in the data base are equal. NOW,
'SqlCommand cmd = new SqlCommand("Select * from tbl_Log where @P1=userName and @P2=password", conn); this is my query to get data cmd.Parameters.AddWithValue("@P1", txtUsername.Text); cmd.Parameters.AddWithValue("@P2", hash.hashPassword(txtPassword.Text)); I want to write if(txtUsername.Text == "@P1" && hash.hashPassword(txtPassword.Text) == "@P2" ) and if work go to admin panel this is possible but I don't know what am I writing instead "@P2" in the if statement? do you have any idea?

database stored hash manuelly

private void Login_btn_Click(object sender, EventArgs e)
    {

        conn.Open();
        SqlCommand cmd = new SqlCommand(@"Select * from tbl_Log where @P1=userName and @P2=password", conn);

        string tmpPass = txtPassword.Text;
        string salt = BCrypt.Net.BCrypt.GenerateSalt(12);
        string hashPwd = BCrypt.Net.BCrypt.HashPassword(tmpPass, salt);

        cmd.Parameters.AddWithValue("@P1", txtUsername.Text);
        cmd.Parameters.AddWithValue("@P2", hashPwd);



        SqlDataReader dr = cmd.ExecuteReader();


        if (dr.Read())
        {
            string tempUsername = dr["userName"].ToString().Trim();
            string tempPassword = dr["password"].ToString().Trim();

            if (txtUsername.Text == tempUsername && hashPass == tempPassword)
            {
                loginSuccesfull_Admin lS_Admin = new loginSuccesfull_Admin();
                lS_Admin.Show();
                this.Hide();

                dr.Close();
                conn.Close();

            }
            else
            {
                MessageBox.Show("You entered wrong username or password!");
            }

        }
        else
        {
            conn.Close();
        }


    }

where am ı doing wrong? could you explain and make a example for me thanks for your help!

Answer 1

Hashes are salted, which means that identical input creates unique output. This is a feature to add more security to storing user sensitive data and the main reason on why hashes are so safe. Therefore (unlike with encrypted passwords) it makes them one-way only and you can not compare two different hashes simply because they had the same original input. What you must do instead is compare the value to the stored hash for validity. With BCrypt you can do this in the following way:

var isValid = BCrypt.Net.BCrypt.Verify(password, hash);