getting a hashed password

[dushkin]

hi. i am new to sql and recently wrote a login.aspx script that doesn't work no matter what i seem to do. I have a SHA1 hashed password in the database and i am wondering if there is something in particular i have to do to verify it. It authenticates true or false based on the email/pass match. code below:

if(Page.IsValid) 
	{

	bool authenticated;
	SqlDataReader reader;
	const string connStr = 
	"data source= SERVER\\NETSDK;" +
		"Initial Catalog = master;" +
		"User ID = sa;" +
		"Password =";
	SqlConnection conn=new SqlConnection(connStr);
	String sHashedPassword = FormsAuthentication.HashPasswordForStoringInConfigFile(Pass.Text,"SHA1");
	string sql = "SELECT EmailAddress FROM members WHERE EmailAddress ='" +
	Email.Text + "' AND Password ='"+ sHashedPassword +"'";
	SqlCommand comm=new SqlCommand(sql, conn);
	conn.Open();

	reader=comm.ExecuteReader();
			
	if(reader.Read()) 
			
	{
		authenticated = true;
	}
			
		else 
	{
		authenticated = false;
	}
		
		reader.Close();
		conn.Close();
		conn.Dispose();
	}

}

 

[dushkin]

let me put this another way...

how does one match the hashed password in login to sql server with the hashed password that exists in the Members
file? I can't hash it again. How do you get the appropriate SHA1 hash at login to match the already hashed
pwd in the database?

any help would be appreciated.

thanks.

 

[MDXer]

you have to hash the password the user enters and then compare that result to the saved hash value.

"Shoot Me! Shoot Me NOW!!!"
- Daffy Duck

 

[dushkin]

that is what i guess i am not understanding.
the registered hash is on the word "duck", lets say.
the hash is "thrhehdhcnfhhsdhg", lets say.
now, on login, the hash on "duck", gets a encrypted
value of "nkaswdfasjsdf"... something completely
different. in this way, no two passwords will ever
match up. what am i doing wrong?

thanks again.

 

[MDXer]

looks like your encryption key is diffrent. I'm not an expert on encryption or sha1 but that would be my guess.

"Shoot Me! Shoot Me NOW!!!"
- Daffy Duck