Check and change user password

Question

I have a simple C # windows form that acts like a login, but also has a form for changing a user's password.

When you click the "Change Password" button, the form is loaded with the text field of the current password, a new pass and confirmation of a new pass and one save button.

I saved the username in a shortcut so that the current password can be checked if it is valid from the database or not.

I save them in a table that I created in Microsoft SQL Server 2008.

The code is as follows.

SqlConnection connect = new SqlConnection(str); connect.Open(); string username = label_username.Text; string password = textBox_Current.Text; string newPassword = textBox_New.Text; string confirmPassword = textBox_Verify.Text; string sqlquery = "UPDATE [Member] SET Password=@newpass where Username=@username "; SqlCommand cmd = new SqlCommand(sqlquery, connect); cmd.Parameters.AddWithValue("@newpass", textBox_Verify.Text); cmd.Parameters.AddWithValue("@username", label_username.Text); cmd.Parameters.AddWithValue("@password", textBox_Current.Text); cmd.Connection = connect; cmd.ExecuteNonQuery(); sqlDataReader reader = null; reader = cmd.ExecuteReader(); while (reader.Read()) { if ((textBox_New.Text == reader["newPassword"].ToString()) & (textBox_Verify.Text == (reader["confirmPassword"].ToString()))) { } } MessageBox.Show("Password Changed Successfully!"); this.Close(); 

When the above code is executed, the password is changed, but I want:

• check the check, for example, if the user has typed the wrong password in the current password.
• newpassword and confirm the password.
• when the user clicks first to save the lower empty password, it should not be stored in the database, rather, it should indicate the message "please enter the password"

How can I do that?

Answer 1

You really should not store these passwords in plain text. You must enter a password and save the hash. Then, if you want to verify that the password is correct, enter the user password and compare it with the hash stored for the user.

But it looks like you need help getting the value from the database for the current user. Putting something like this in it, you need to do it for you. Please note that, as I said above, this should really retrieve the password hash, not the actual password in plain text.

 string sqlquery = "SELECT Password FROM [Member] where Username=@username "; SqlCommand cmd = new SqlCommand(sqlquery, connect); cmd.Parameters.AddWithValue("@username", label_username.Text); cmd.Connection = connect; string currentPassword = (string)cmd.ExecuteScalar(); if (currentPassword == textBox_Current.Text) { // PASSWORD IS CORRECT, CHANGE IT, NOW. } else { // WOW EASY BUDDY, NOT SO FAST } 

Answer 2

You must first use password hashing in your application, so the password fields in the database must contain hashed values.

Assuming this to achieve your goals,

• consider your line name -> Hash it -> write a query to check if this hashed value and the hash value of the password of the user stored in the database is the same
• consider the string password and the newPassword string in your code -> Hash both -> check if the hash values ​​are the same
• consider the string password and the string newPassword → check if each of them is zero or the length is 0

You must also complete these tasks in the following order:

1 → 3 → 2

Hope this helps ...

Answer 3

  protected void btn_PasswordChange(object sender, EventArgs e) { string constring = DataAccess.GetConnection(); SqlConnection con = new `SqlConnection`(constring); { if (con.State != ConnectionState.Open) con.Open(); } string str = "select * from tbl_MemberLogin where Password='" + txtoldpwd.Text + "'"; DataTable DT = new DataTable(); DT = objdut.GetDataTable(str); if (DT.Rows.Count == 0) { lblmsg.Text = "Invalid current password"; lblmsg.ForeColor = System.Drawing.Color.Red; } else { SqlCommand cmd = new SqlCommand(); cmd.CommandText = "update tbl_MemberLogin set Password='" + txtnewpwd.Text + "' where UserName='" + Session["UserName"].ToString() + "'"; cmd.ExecuteNonQuery(); lblmsg.Text = "Password changed successfully"; lblmsg.ForeColor = System.Drawing.Color.Green; } }