Re: New to C# - DB question

Some security advice;

A: don't ever store passwords (even cyphered) unless you **really** nead to.
Perhaps hash them and compare hashes... and use a known hash (MD5 or
similar), not the CLR GetHashCode(), as that is implementation specific.

B: don't use string concatenation to place parareters into a SQL string -
you should be using the parameters collection instead (along with whichever
syntax is suitable in your SQL, for instance "?" or "@SomeParam" etc - refer
to documentation).

Firstly, you will run into trouble with the O'Neil's of this world. More
importantly, the reason for this is the simple trick of SQL-injection: for
instance, I could enter (as my user id on the form):
Fred' SELECT * FROM sysobjects --

or about 1000 other things (DROP TABLE... SELECT username, password...); you
can waste a lot of time trying to protect yourself by escaping characters
such as quotes, but the parameters approach deals with it all *much* more
efficiently, robustly and safely.

Best of luck,

Marc


.

Relevant Pages

  • Re: GetHashCode() not consistent?
    ... it for hashing should be fine. ... > that came to my mind was "aha, they derive the default hash ... > value from the memory address of the object and then, ... The rules in GetHashCode aren't too bad - it's just the extra stuff ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: about Equals and GetHashCode
    ... distribution would be completely random. ... I'm not sure how important it is for the hash ... distribution of GetHashCode should be random. ... read your blog posts so I'll catch it if you do decide to post on the ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: GetHashCode for Objects that Compare Based on Value (Not reference equality)
    ... When collections and nested types are brought into the picture, ... objects extensively in collections that query the hash code frequently. ... Hashtable shouldn't make too many calls to GetHashCode(). ... data structure to prevent having to do it later. ...
    (microsoft.public.dotnet.framework)
  • Re: Complex Objects as Hash Keys
    ... > Therefore you can't use the deault GetHashCode implementation for hashing. ... >> I don't think garbage collection could ever change the hash. ... >> making mutating changes to the object could. ...
    (microsoft.public.dotnet.framework)
  • Re: MulticastDelegate.GetHashCode returns not usable hashs in .NET
    ... One cannot identify the delegate by the hash it returns. ... Then you have a bug. ... You should not rely on GetHashcode giving ... The documentation in MSDN is wrong, and *has* to be wrong by the pigeon ...
    (microsoft.public.dotnet.framework)
Loading