How do you verify a password with upper and lower case?

[tripnotic]

I know how to verify a password that is the exact words but I don't know how to verify a password with upper and lower case to it.

What is some of the method to get this done?

Thanks!

Don

[tripnotic]

This would be relating to what is shown in the database, not confirming between two textbox(Password and Confirm Password)

[danasegarane]

What server you are using

[tripnotic]

Window 2000 server and Windows XP for development testing.

What does this has to do with the server? I don't understand.

[rabid lemming]

Ummm...maybe I’m wrong but could you not just add this

.ToString.ToLower

so it be like

if UserName.ToString.ToLower = DataBaseUserName.ToString.ToLower then ....

That way if the database or textbox, entry had a string with either upper, lower or both case type letters; the code would make them the same case for a compression

That’s just an idea like. If you wanted to make it so the user had to have a user name who's letter were the exsact same case as one in a data base to mach i.e. “MyPasSWoRD” would have to be like that to mach the database to be allowed, then would it not just be an exact string match ?

[tripnotic]

That’s just an idea like. If you wanted to make it so the user had to have a user name who's letter were the exsact same case as one in a data base to mach i.e. “MyPasSWoRD” would have to be like that to mach the database to be allowed, then would it not just be an exact string match ?

yeah, that what I thought too but it didn't work. I'm using MS Access for the web application.

[Lord_Rat]

If you are doing the comparison in the database itself, the database is by default not case sensitive. You would have to load it in to a local (to the program itself) variable and then do the comparison in the program.

However, you aren't storing passwords in plain text in your database are you? ARE YOU?

o_O

[mendhak]

I know how to verify a password that is the exact words but I don't know how to verify a password with upper and lower case to it.

What is some of the method to get this done?

Thanks!

Don

You shouldn't have to, and shouldn't.

[tripnotic]

If you are doing the comparison in the database itself, the database is by default not case sensitive. You would have to load it in to a local (to the program itself) variable and then do the comparison in the program.

However, you aren't storing passwords in plain text in your database are you? ARE YOU?

o_O

This is what I do:
objCmd = new OleDbCommand("SELECT * FROM Employees WHERE Username='" + strUsername + "' AND Password='" + strPassword + "'", objConn);

return true if there is any record found. Am I checking the password wrong?


Plain text as in the data type set as TEXT? if so, then Yes.

You shouldn't have to, and shouldn't.

what do you mean by I shouldn't?

[mendhak]

what do you mean by I shouldn't?

It implies that you're storing the passwords as plaintext in your database. (Which is bad)

Second, you're creating inline SQL statements which are open to SQL injection attacks. (Which is bad)

Third, passwords should be case sensitive anyways, but you're looking to match the passwords up no matter the case. (Which is bad)

[Lord_Rat]

Your last part is wrong, Mend. His problem was that he WANTED them to be case sensitive, but they were passing regardless of case.

Trip, here is the *proper* way of doing passwords:

Develop a hash. The Cryptographic provider of .Net makes doing so much less of a pain than it used to be.

When a user sets up a password for the first time, hash it against your internal cryptographic provider and then store the hash in the database.

When a user attempts to log in again, read the hash from the database, something like this:

SELECT Hash FROM tblUserInfo WHERE UserName = @UserName

You define @UserName using Parameterization (a quick search on these boards should tell you everything you wanted to know about Parameterization)

Then, you take the hash you read out of the database and compare it to the hash you just generated from their password. If they match, you log them in. If not, you tell them to give their PC to their grandmother and never touch the Internet again.

[mendhak]

His first line was confusing enough

[Lord_Rat]

But the implied statement of course, is that you were right on the first two points, =)

And that third eye.... that's something else =)

[tripnotic]

It implies that you're storing the passwords as plaintext in your database. (Which is bad)

Second, you're creating inline SQL statements which are open to SQL injection attacks. (Which is bad)

Third, passwords should be case sensitive anyways, but you're looking to match the passwords up no matter the case. (Which is bad)

So use store procedure with parameterization to verify login and password rather inline sql statements? Or there is something else you are recommending? The code above is what I learn through a book 2 years ago and didn't learn the right way of verify logins.

Sorry about confusing you, I was referring to check the password that is case-sensitive but couldn't think of the right term at the time.

Trip, here is the *proper* way of doing passwords:

Develop a hash. The Cryptographic provider of .Net makes doing so much less of a pain than it used to be.

Thanks! I also learn how to salt the password before hashing it.

[mendhak]

So use store procedure with parameterization to verify login and password rather inline sql statements?

Yep, that's what I'm recommending.