Question

Hey so at the moment in my table I have a column called

“hash”
and
“salt”

hash is my Hashpassword of the user entered string and salt

and salt is the single salt value

During user login rather than retreive the salt from DB, create the hashpasword in my code and then compare with hash in DB I am told I can do this straight in my stored procedure.

This is my stored procedure at the moment

ALTER PROCEDURE [dbo].[spCheckMemberLogin]
(
    @username VARCHAR(100) = default,
    @hash VARCHAR(100) = default
)
AS
BEGIN

    SET NOCOUNT ON;

    SELECT
         3 as result
    ,    * 
    FROM
        web_user 
    WHERE 
        (statusId = 1) 
        AND (useremail = @username) 
        AND (hash = @hash)

END

Instead of having
hash = @hash

How can I have

hash = HashBytes(‘SHA1’, salt+user entered password)

where salt should be retrieve from table and user entered password is a variable of the stored procedure

Answer 1

It depends on your version of SQL server. Anything equal or superior to 2005 will have the HashBytes procedure:

http://msdn.microsoft.com/en-us/library/ms174415.aspx