如何在數據庫中更改密碼時已經在數據庫中散列密碼asp.net C＃

Question

嗨，我的問題是如何更改密碼時，其已經哈希和鹽，我有Web應用程序的asp.net C＃和我想改變密碼選項在我的網站，但我不能更改數據庫中的密碼，如果有人知道這樣做，然後請幫助或提前考慮鏈接感謝提前。

這裏是我的代碼

List<String> salthashlist = null; 
     List<String> newlist = null; 
     try 
     { 
      SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["RegisterConnectionString"].ConnectionString); 
      conn.Open(); 
      QueryStr = "select Password,UserName FROM UserData WHERE UserName= @uname"; 
      cmd = new SqlCommand(QueryStr, conn); 
      cmd.Parameters.AddWithValue("@uname", Userlbl.Text); 
      reader = cmd.ExecuteReader(); 
      while (reader.HasRows && reader.Read()) 
      { 
       if (salthashlist == null) 
       { 
        salthashlist = new List<String>(); 
        newlist = new List<String>(); 
       } 
       String salHashes = reader.GetString(reader.GetOrdinal("Password")); 
       salthashlist.Add(salHashes); 
       String fullname = reader.GetString(reader.GetOrdinal("UserName")); 
       newlist.Add(fullname); 
      } 
      reader.Close(); 
      if (salthashlist != null) 
      { 
       for (int i = 0; i < salthashlist.Count; i++) 
       { 
        QueryStr = ""; 
        bool validuser = PasswordHash.Validatepass(oldpasswordtxt.Text, salthashlist[i]); 
        if (validuser == true) 
        { 
         Session["New"] = newlist[i]; 
         Response.BufferOutput = true; 
         String salthashreturned = PasswordHash.makehash(newpassconfirmtxt.Text); 
         int commaindex = salthashreturned.IndexOf(":"); 
         String extractedstring = salthashreturned.Substring(0, commaindex); 
         commaindex = salthashreturned.IndexOf(":"); 
         extractedstring = salthashreturned.Substring(commaindex + 1); 
         commaindex = extractedstring.IndexOf(":"); 
         String salt = extractedstring.Substring(0, commaindex); 
         commaindex = extractedstring.IndexOf(":"); 
         extractedstring = extractedstring.Substring(commaindex + 1); 
         String hash = extractedstring; 
         cmd.Parameters.AddWithValue("@password", salthashreturned); 
         passchangelbl.Text = "Your new password is changed successfully"; 
         cmd.ExecuteReader(); 
         conn.Close(); 
        } 
        else 
        { 
         passchangelbl.Text = "Please check your old password"; 
        } 
       } 
      } 
     } 
     catch (Exception ex) 
     { 
      passchangelbl.Text = "Please check your password" + ex; 
     } 

Answer 1

您需要更新新密碼到數據庫中。你忘了這麼做。您執行不正確的SELECT命令。

... 
if (validuser == true) 
{ 
    ... 
    // error here: 
    cmd.Parameters.AddWithValue("@password", salthashreturned); 
    passchangelbl.Text = "Your new password is changed successfully"; 
    cmd.ExecuteReader(); 
    conn.Close(); 
} 

您需要UPDATE密碼哈希數據庫。原理：

... 
if (validuser == true) 
{ 
    ... 

    // possible solution in principle: 
    cmd = new SqlCommand(
     "UPDATE UserData SET Password=@newPassword WHERE UserName= @uname", conn); 
    cmd.Parameters.AddWithValue("@uname", Userlbl.Text); 
    cmd.Parameters.AddWithValue("@newPassword", salthashreturned); 
    cmd.ExecuteScalar(); 
    conn.Close(); 
    passchangelbl.Text = "Your new password is changed successfully"; 
}