How to hash a password and save into a database table?

Question

I have a form register.aspx and a login function and I am using vb.net

In my register.aspx I have two textboxes, for user name and password and a submit button. If the user click's on the submit button, the password will be hashed and stored with the username in the database table called Customer

I would like to know-

1) How to hash a password?

2) How to compare the hashed value in database with the password entered in the textbox while login?

Answer 1

To answer your questions in order.

1. You simply use one of the crypto classes, following the documentaion .
2. You store the hashed value in the database, so when you query the database, you use the hash.

Psuedo code:

Function GetUser(name, password)
    hashedPassword = Hash(password)
    sqlcmd = 'select userkey from user where username = @name and password = @pass'
    add cmd parameter ('@name', name)
    add cmd parameter ('@pass', hashedPassword)
    userKey = cmd.executequry
    Return userkey
 End Function

That said, don't do this if you can implement OpenID instead. The world really doesn't need another site where you have to remember or share a password for no good reason.

Answer 2

You may use FormsAuthentication.HashPasswordForStoringInConfigFile static method (System.Web.Security namespace).

Dim plain="abc"
Dim hash= FormsAuthentication.HashPasswordForStoringInConfigFile(plain, "MD5")