如何在coldfusion中將密碼作爲散列插入Ms SQL？

Question

我正在創建一個保存用戶註冊的表單。我想將密碼作爲散列或md5插入數據庫。

這是我的HTML表單很少的ColdFusion代碼：

 <form id="myForm" class="ui form segment" method="post" action="registeraction.cfm"> 
     <p>Let's go ahead and get you signed up.</p> 

     <div class="field"> 
     <div class="field"> 
     <label>Name</label> 
     <input placeholder="Name" name="name" type="text"> 
     </div> 
     </div> 

     <div class="field"> 
     <div class="field"> 
     <label>Email</label> 
     <input placeholder="Email" name="email" type="email"> 
     </div> 
     </div> 

     <div class="field"> 
     <div class="field"> 
     <label>Password</label> 
     <input placeholder="Password" name="password" type="password"> 
     </div> 
     </div> 


     <input class="ui blue submit button" type="Submit" value="Submit"> 
    </form> 

這是registeraction.cfm代碼：

<!--- Insert the new record ---> 
<cfinsert datasource="mydatasource" tablename="Users"> 

<h1>User Added</h1> 
<cfoutput> You have added #Form.name# #Form.email# to the testdb database. 
</cfoutput> 

Answer 1

我認爲這應該適合你。在registeraction.cfm只是創建哈希並將其存儲在form.password（我會建議使用CFC的任何業務邏輯和使用CFM僅用於演示）

<cfset form.password = Hash(Form.password, "SHA") > 
    <!--- Insert the new record ---> 
    <cfinsert datasource="mydatasource" tablename="Users"> 

<h1>User Added</h1> 
<cfoutput> You have added #Form.name#  #Form.email# to the testdb database. 
</cfoutput> 

Answer 2

對於衆所周知的hashings，您可以使用SQL Server內置功能HASHBYTES() - 返回VARBINARY

例如：

INSERT INTO dbo.table (Password) VALUES (HASHBYTES('MD5', 'plaintext'))

Answer 3

你應該避免使用MD5，它被認爲是一個弱算法。見： How weak is MD5 as a password hashing function ?

此外，你不應該只是散列密碼，你應該將純文本密碼與鹽。欲瞭解更多信息，請參閱：OWASP: Password Storage Cheat Sheet