Member Avatar for Naters_uk

I am currently working to store passwords into my SQLDatabase table. I would like to hash the password columns to make it more secure. I know that i can use either SHA1 or MD5.

Refering to this website, , i try to write the VB.NET codes.

Private Sub EncryptPassword()

FormsAuthentication.HashPasswordForStoringInConfigFile(txtbox_password.Text, "SHA1")

myDataset.Tables("Member").Rows(myDataIndex)("MemberPassword") = txtbox_confirmpass.Text
dtDataAdapter.Update(mydataset)
End Sub

The hashing works but i am unable to insert it into the database as the hash value. Also, Forms authentication requires me to manually copy and paste the username and password each time to store the hash to the table. I want to be able to store the hashed password to the table directly and i think i can use update statement but it isn't working, my table name is Member, the password column is MemberPassword. Would someone kindly help me. :cry:

  • 3 Contributors
  • 3 Replies
  • 256 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by Naters_uk

Dani AI

Generated

Short summary and practical next steps based on the thread: the immediate issue you hit was a storage/type/length problem (as suggested) rather than the hashing call itself. The hashing routine must produce a string or binary that actually fits the database column, and a disconnected update will only work if the DataAdapter has the appropriate commands and the DataTable schema matches the DB columns (as pointed out). (learn.microsoft.com)

Modern guidance: stop using MD5 or plain SHA1 for password storage. Use a slow, salted, adaptive password hasher (Argon2, scrypt, bcrypt or PBKDF2) and keep metadata (algorithm and cost) with each stored password so you can upgrade later. Also generate a cryptographically-random salt per account and store it alongside the hash. These are current best-practices from security guidance. (cheatsheetseries.owasp.org)

A minimal, practical VB.NET workflow (PBKDF2 example) — produce a salt, derive a key, combine metadata, then update the DB with a parameterized command:

' Illustrative only; use your connection/parameter classes
Imports System.Security.Cryptography
Imports System.Text

Dim password As String = txtPassword.Text
Dim iterations As Integer = 200_000
Dim salt As Byte() = RandomNumberGenerator.GetBytes(16)
Dim hash As Byte() = Rfc2898DeriveBytes.Pbkdf2(password, salt, iterations, HashAlgorithmName.SHA256, 32)

Dim stored As String = String.Format("{0}:{1}:{2}", iterations, Convert.ToBase64String(salt), Convert.ToBase64String(hash))

Using conn As New MySqlConnection(connString)
  conn.Open()
  Using cmd As New MySqlCommand("UPDATE Member SET MemberPassword = @p WHERE MemberID = @id", conn)
    cmd.Parameters.AddWithValue("@p", stored)
    cmd.Parameters.AddWithValue("@id", memberId)
    cmd.ExecuteNonQuery()
  End Using
End Using

Use the one-shot PBKDF2 API shown above (preferred over older constructors) and verify with a constant-time compare when checking passwords. (learn.microsoft.com)

Storage and troubleshooting tips: pick a column type/length that fits the full stored string (MCF-style strings like bcrypt are ~60 chars; Argon2 strings and future formats can be longer — VARCHAR(255) or a VARBINARY field are safe choices). If Update still fails, confirm the DataAdapter has an UpdateCommand/InsertCommand, verify DataColumn.MaxLength in the DataTable, and check AcceptChangesDuringFill/RowState flow. Plan a migration path so legacy SHA1/MD5 hashes are re-hashed with a modern algorithm on next login. (pkg.go.dev)

Recommended Answers

All 3 Replies

Member Avatar for cambia

What is it that's not working? What is the error or exception you're getting?

You should be able to use the Update method to store data in the database, but your DataAdapter must be setup properly and the types and lengths of your database fields must be capable of storing the hash string. I think your problem is more about reading and writing to the database than hashing a password. Try doing some simple experiments to be sure you can use the Fill and Update methods of the data adapter in the way you expect.

Member Avatar for Paladine

What is the data_type you have set for the column storing this hashed password? char, varchar?

Member Avatar for Naters_uk

Char, thanks alot, the problem has been resolved!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.