Creating a user registration form How should I go about creating a registration page in Windows forms? I can easily create a registration page, but I'm not sure if it's the best way. I'd have a service account that is hard coded, and it creates entries in a user table. I don't like to hard code passwords, but I don't know of another way. I guess in every case I'd end up having to hard code a password, right? I do have SSL enabled, and I've Wiresharked it and was unable to read any of the traffic.

Here's a simplified example of some code I wrote a while ago:



Public Class Registration
Dim connStr As String = "server=domain.com; port=3306; user id=userid;password=password;database=db;SslMode=Required;"
Dim msc As New MySqlConnection

Private Sub registerBTN_Click(sender As System.Object, e As System.EventArgs) Handles registerBTN.Click
            Dim dr As MySqlDataReader
                dr = checkUsername.ExecuteReader()
            Dim match As Boolean = False
            While dr.Read()
                If dr("Username").ToString = usernameTXT.Text Then
                    match = True
                    Exit While
                End If
            End While
            dr.Close()
            If match = False Then
                Dim User_GUID As Guid = New Guid
                User_GUID = Guid.NewGuid()
                Dim Encrypted_Password As String = Encryption(passwordTXT.Text, User_GUID.ToString)
                    Dim mscCMD As MySqlCommand = New MySqlCommand("INSERT INTO Users (Username, UserID, Password, Profile, Email) " &amp; _
                                                                      "VALUES (@uname, @id, @pwd, @url, @mail)", msc)
                    With mscCMD.Parameters
                        .AddWithValue("uname", usernameTXT.Text)
                        .AddWithValue("id", User_GUID.ToString)
                        .AddWithValue("pwd", Encrypted_Password)
                        .AddWithValue("url", urlOptTXT.Text)
                        .AddWithValue("mail", emailTXT.Text)
                    End With
                    mscCMD.ExecuteNonQuery()
                MsgBox("Registration successful!", MsgBoxStyle.Information)
                My.Settings.First_Run = False
                Me.DialogResult = Windows.Forms.DialogResult.OK
                Me.Close()
End Sub

Private Sub Registration_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Try
            msc.ConnectionString = connStr
            msc.Open()
        Catch ex As MySql.Data.MySqlClient.MySqlException
            Me.Close()
        End Try
    End Sub


I want to know if this is a good approach. Does this have any vulnerabilities? Is there a better way to create a user registration method?

Also, here's my encryption/decryption.

Public Function Encryption(ByVal Plaintext_Password As String, ByRef User_GUID As String) As String
    Dim guidANDPassword As String = User_GUID.ToString + Plaintext_Password
    Dim shaobj As New Security.Cryptography.SHA1CryptoServiceProvider
    Dim guidPwdBytes() As Byte = System.Text.Encoding.ASCII.GetBytes(guidANDPassword)
    guidPwdBytes = shaobj.ComputeHash(guidPwdBytes)

    Dim Encrypted_Password As String = String.Empty

    For Each b As Byte In guidPwdBytes
        Encrypted_Password += b.ToString("x2")
    Next
    User_GUID = User_GUID.ToString()
    Return Encrypted_Password
End Function


Public Function Decryption(ByVal Plaintext_Password As String, ByVal User_GUID As String) As String
    Dim guidANDPassword As String = User_GUID.ToString + Plaintext_Password
    Dim shaobj As New Security.Cryptography.SHA1CryptoServiceProvider
    Dim guidPwdBytes() As Byte = System.Text.Encoding.ASCII.GetBytes(guidANDPassword)
    guidPwdBytes = shaobj.ComputeHash(guidPwdBytes)
    Dim Encrypted_Password_Of_Specified As String = String.Empty

    For Each b As Byte In guidPwdBytes
        Encrypted_Password_Of_Specified += b.ToString("x2")
    Next
    Return Encrypted_Password_Of_Specified
End Function
If you are going to distribute this assembly, you are effectively distributing that password.  Tools such as ILSpy can decompile the assembly and the database will be compromised.

The Windows Forms application shouldn't directly connect to a remote SQL server, there should be a service or API layer on the web sever to handle that.

If you need to authenticate / authorize a user, they will need to each have their own logins.

WinForms should act like a thin client, just sending requests to the server and receiving responses.

The web server should receive, authenticate, authorize and execute those requests on the database, and then send a response.