Question

At last i try Encryption and Compression Functions in mysql for secure password and username.

DES_ENCRYPT function is perfectly work for encrypt. I give the code which i use to encrypt and save in database.

MySqlConnection connection = new MySqlConnection(MyConString);
MySqlCommand command = connection.CreateCommand();
command.CommandText = "insert into user (User_Id, Password, Branch, Upto_Date) values (DES_ENCRYPT('" + textBox1.Text + "'),DES_ENCRYPT('" + textBox2.Text + "'),'" + comboBox1.SelectedItem.ToString() + "','" + textBox4.Text + "') ";
connection.Open();
command.ExecuteNonQuery();
MessageBox.Show("Record Succesfully Added", "Information", MessageBoxButtons.OK, MessageBoxIcon.Information);
connection.Close();

But i have trouble to retrieve data in DES_DECRYPT function.

I try "select DES_DECRYPT(User_Id),DES_DECRYPT(Password),Branch,Upto_Date from user"
code to retrieve but no use,. What i do for get the data from mysql datatable?.

the last record is inserted using DES_ENCRYPT() function.

Answer 1

DES_DECRYPT is the way to decrypt DES_ENCRYPTed data.

Lets stick to the SQL part of it. Easy example:

/* generating test table */
CREATE TABLE `test` (
  `testField` varchar(512) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1

/* adding some test data to it */
INSERT INTO test () VALUES (DES_ENCRYPT("Hello")), (DES_ENCRYPT("World"));

Now to find out how it does look encrypted…

SELECT testField FROM test;

+-------------+
| testField   |
+-------------+
| €p!˜*D°k    |
| €ü«ü€D»Ûë   |
+-------------+

…and decrypt it!

SELECT DES_DECRYPT(testField) FROM test;

+-------------+
| testField   |
+-------------+
| Hello       |
| World       |
+-------------+

Basically, if you decrypt it this way as you’ve described it, the database should return the plain text.

My advice:

1. Try to start with figuring this out on the SQL side first (phpmyadmin, SQLyog, there are plenty of tools to directly work on the MySQL database).
2. If this is working, move to your .NET program to finish this.

Another note, if you use this kind of password protection, a clear password is used between your application and the database server. Even if this connection might be SSL-“protected”, I’d advise to not do it this way. It usually is safer to use Hash-Algorithms (like SHA512) for this purpose and just store the Hashes in your database to avoid clear passwords at all.