從數據庫檢索鹽

Question

我有一個與我的winforms程序相關的數據庫。它存儲名稱，usertype，哈希和鹽。我排序了註冊和寫作細節，但我不知道如何將鹽（從數據庫讀取時）作爲變量保存。這裏是我的代碼：

public string getSalt() 
    { 
     SqlConnection connection = new SqlConnection(@"server=.\SQLEXPRESS; database=loginsTest;Trusted_Connection=yes"); 
     connection.Open(); 
     string selection = "select DISTINCT Salt from Logins where Name = '"+userNameBox.Text+"'"; 
     SqlCommand command = new SqlCommand(selection, connection); 
     if (command.ExecuteScalar() != null) 
     { 
      connection.Close(); 
      return selection; 
     } 
     else 
     { 
      connection.Close(); 
      return "Error"; 
     } 
    } 

正如你可以看到，它的返回選項，即「+ userNameBox.Text +‘‘’從哪裏登錄名= SELECT DISTINCT鹽’」。我如何將鹽保存爲要返回的變量？

Answer 1

這應該這樣做，而且還修復了原有的鴻溝SQL注入漏洞：

public string getSalt() 
{ 
    string sql = "select DISTINCT Salt from Logins where Name = @username"; 

    using (var connection = new SqlConnection(@"server=.\SQLEXPRESS; database=loginsTest;Trusted_Connection=yes")) 
    using (var command = new SqlCommand(sql, connection)) 
    { 
     //guessing at the column length here. Use actual column size instead of 20 
     command.Parameters.Add("@username", SqlDbType.NVarChar, 20).Value = userNameBox.Text; 

     connection.Open(); 
     return (command.ExecuteScalar() as string) ?? "Error"; 
    } 
}