title: saving and comparing passwords to database as binary using md5
body: <p>In an ASP.NET application, I have saved a password to the database as "Binary" data using md5. </p>
  
  <p>How can I now compare passwords?</p>
  
  <p>I used the <a href="http://www.aspnettutorials.com/tutorials/advanced/md5-pw-encryption-asp4-cs.aspx" rel="nofollow">code in this article to encrypt the password with md5</a></p>
  
  <p>The code is working. How can I compare the password when users enter their password at login? What's the code to check if the password is matched with encrypted password in database.  </p>
  
  <p>I used the following code, but it always display "Incorrect username or password" even if it's correct."the modifird code"</p>
  
  <pre><code>Byte[] hashedBytes;
      string Password = txtPassword.Text;
      MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
      UTF8Encoding encoder = new UTF8Encoding();
  
      hashedBytes = md5Hasher.ComputeHash(encoder.GetBytes(Password));
      Byte[] pass = new Byte[16];
      SqlConnection conn = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
  
      SqlCommand cmd = new SqlCommand("SELECT * FROM Users WHERE UserName=@UserName", conn);
      cmd.Parameters.AddWithValue("@UserName", txtUserName.Text);
      conn.Open();
      SqlDataReader rdr = cmd.ExecuteReader();
      if (rdr.Read())
          pass = (Byte[])rdr["password"];
  
      foreach (Byte b in pass)
      {
          Label1.Text += b.ToString() + " ";
  
  
  
          //Response.Write(b.ToString());
  
          string UserName = txtUserName.Text;
          bool isMatch = false;
          Byte[] password = new Byte[16];
  
          SqlConnection con = new SqlConnection("Data Source=Shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
          con.Open();
  
          SqlCommand cmdd = new SqlCommand(string.Format("select * from Users where UserName='{0}'", UserName), con);
          cmd.CommandType = CommandType.Text;
          cmd.Parameters.AddWithValue("@UserName", txtUserName.Text);
          SqlDataReader dr = cmdd.ExecuteReader();
          if (dr.Read())
          {
              password = (Byte[])dr["Password"];
          }
          foreach (Byte c in password)
          {
              Label2.Text += c.ToString() + " ";//I didnt close the pracket fo that reason data is repeted if I close it I cant type c.toString
  
  
  
              while (dr.Read())
              {
  
                  if (b.ToString() == c.ToString()) // I mean this statment
                  {
                      isMatch = true;
                  }
              }
          }
  
  
  
  
          dr.Close();
          con.Close();
  
          if (isMatch)
          {
              Response.Write("correct");
          }
          else
          {
              Response.Write("Incorrect username or password!");
          }
  
      }
  </code></pre>
  
  <p>the edited code
  protected void Button1_Click(object sender, EventArgs e)
      {
      }
      public static bool ValidateUser(string userName, string password)
      {
          SqlConnection con = new SqlConnection("Data Source=shihab-PC;Initial Catalog=test;User ID=sh;password=admin");
          con.Open();</p>
  
  <pre><code>    using (var connection = new SqlConnection("connectionString"))
      using (var command = connection.CreateCommand())
      {
          command.CommandText = "SELECT dbo.checkUserExists (@userName, @password)";
          command.Parameters.Add("@userName", SqlDbType.NVarChar, 25).Value = userName;
          command.Parameters.Add("@password", SqlDbType.NVarChar).Value = GenerateHash(password);
  
          connection.Open();
          return (bool)command.ExecuteScalar();
      }
  }
  
  private static string GenerateHash(string value)
  {
      return Convert.ToBase64String(new System.Security.Cryptography.HMACSHA1(Encoding.UTF8.GetBytes("salt")).ComputeHash(Encoding.UTF8.GetBytes(value)));
  }
  </code></pre>
  
  <p>}</p>