我无法登录,因为我的密码已经在数据库中加密了

本文关键字:数据库 加密 密码 登录 我的 因为 | 更新日期: 2023-09-27 18:02:07

这是我的注册页面与加密方法。我加密了密码:

protected void Page_Load(object sender, EventArgs e)
    {
        if (IsPostBack)
        {
            SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["RegistrationConnectionString"].ConnectionString);
            conn.Open();
            string checkuser = "select count(*) from UserData where Username = '" + txtUser.Text + "'";
            SqlCommand scm = new SqlCommand(checkuser, conn);
            int temp = Convert.ToInt32(scm.ExecuteScalar().ToString());
            if (temp == 1) // check if user already exist.
            {
                Response.Write("User already existing");
            }
            conn.Close();
        }
    }
    protected void btn_Registration_Click(object sender, EventArgs e)
    {
        try
        {
            SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["RegistrationConnectionString"].ConnectionString);
            conn.Open();
            string insertQuery = "insert into UserData(Username,Firstname,Lastname,Email,Password,CustomerType,DeliveryAddress,Zip,ContactNumber)values(@Username,@Firstname,@Lastname,@Email,@Password,@CustomerType,@DeliveryAddress,@Zip,@ContactNumber)";
            SqlCommand scm = new SqlCommand(insertQuery, conn);
            scm.Parameters.AddWithValue("@Username", txtUser.Text);
            scm.Parameters.AddWithValue("@Firstname", txtFN.Text);
            scm.Parameters.AddWithValue("@Lastname", txtLN.Text);
            scm.Parameters.AddWithValue("@Email", txtEmail.Text);
            scm.Parameters.AddWithValue("@Password", Encrypt(txtPW.Text));
            scm.Parameters.AddWithValue("@CustomerType", RadioButtonList1.SelectedItem.ToString());
            scm.Parameters.AddWithValue("@DeliveryAddress", txtAddress.Text);
            scm.Parameters.AddWithValue("@Zip", txtZip.Text);
            scm.Parameters.AddWithValue("@ContactNumber", txtContact.Text);
            scm.ExecuteNonQuery();
            Session["Contact"]= txtContact.Text;
            Session["Email"] = txtEmail.Text;
            Session["DeliveryAddress"] = txtAddress.Text;
            label_register_success.Text = ("Registration Successful!");
            //Response.Redirect("Home.aspx");
            conn.Close();
        }
        catch (Exception ex)
        {
            Response.Write("Error:" + ex.ToString());
        }
    }
    private string Encrypt(string clearText)
    {
        string EncryptionKey = "MAKV2SPBNI99212";
        byte[] clearBytes = Encoding.Unicode.GetBytes(clearText);
        using (Aes encryptor = Aes.Create())
        {
            Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
            encryptor.Key = pdb.GetBytes(32);
            encryptor.IV = pdb.GetBytes(16);
            using (MemoryStream ms = new MemoryStream())
            {
                using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
                {
                    cs.Write(clearBytes, 0, clearBytes.Length);
                    cs.Close();
                }
                clearText = Convert.ToBase64String(ms.ToArray());
            }
        }
        return clearText;
    }

,这里是我的登录代码与解密方法。在检查密码是否与用户输入的密码匹配之前,我解密了密码:

 protected void btn_Login_Click(object sender, EventArgs e)
    {
        SqlConnection conn = new SqlConnection("Data Source = 'PAULO'; Initial Catalog=ShoppingCartDB;Integrated Security =True");
        conn.Open();
        string checkuser = "select count(*) from UserData where Username = '" + txtUser.Text + "'";
        SqlCommand scm = new SqlCommand(checkuser, conn);
        int temp = Convert.ToInt32(scm.ExecuteScalar().ToString());
        conn.Close();
        if (temp == 1)
        {
            conn.Open();
            string checkPassword = "select Password from UserData where Username ='" + txtUser.Text + "'";
            SqlCommand passCom = new SqlCommand(checkPassword, conn);
            string password = passCom.ExecuteScalar().ToString();
            password = Decrypt(password);
            if (password == txtPassword.Text)
            {
                Session["New"] = txtUser.Text;
                Response.Write("<script>alert('Logged In')</script>");
                Response.Redirect("OrderNow.aspx");
            }
            else
            {
                lblcrederror.Text = ("Credentials dont match");
            }
        }
        else
        {
            lblcrederror.Text = ("Credentials dont match");
        }
    }
    private string Decrypt(string cipherText)
    {
        string EncryptionKey = "MAKV2SPBNI99212";
        byte[] cipherBytes = Convert.FromBase64String(cipherText);
        using (Aes encryptor = Aes.Create())
        {
            Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
            encryptor.Key = pdb.GetBytes(32);
            encryptor.IV = pdb.GetBytes(16);
            using (MemoryStream ms = new MemoryStream())
            {
                using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateDecryptor(), CryptoStreamMode.Write))
                {
                    cs.Write(cipherBytes, 0, cipherBytes.Length);
                    cs.Close();
                }
                cipherText = Encoding.Unicode.GetString(ms.ToArray());
            }
        }
        return cipherText;
    }

我在这里错过了什么?请帮助。我试图输入一个工作登录,但它给了我一个错误(Base-64字符数组或字符串的无效长度)我的密码是在数据库中的nvarchar(MAX)。

我无法登录,因为我的密码已经在数据库中加密了

您的登录函数需要从数据库中提取用户的密码,并用该密钥对其解密。如果解密的密码与输入的密码匹配,让它们进入。

我会使用盐渍哈希,除非你有特殊的理由可以查看用户的密码。然后你只需要比较哈希值和login。

从数据库中获得密码后,将其传递给这个。

private string Decrypt(string cipherText)
{
    string EncryptionKey = "MAKV2SPBNI99212";
    byte[] cipherBytes = Convert.FromBase64String(cipherText);
    using (Aes encryptor = Aes.Create())
{
    Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
    encryptor.Key = pdb.GetBytes(32);
    encryptor.IV = pdb.GetBytes(16);
    using (MemoryStream ms = new MemoryStream())
    {
        using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateDecryptor(), CryptoStreamMode.Write))
        {
            cs.Write(cipherBytes, 0, cipherBytes.Length);
            cs.Close();
        }
        cipherText = Encoding.Unicode.GetString(ms.ToArray());
    }
 }
 return cipherText;
}

然后如果cipherText =用户输入的密码,登录他们。