Question

I am creating a log in form using ColdFusion, but I cannot figure out the syntax to check the password in my table which is encrypted using SHA256. I have researched this and so far only found complicated answers, mostly unrelated to what I need.

Here is the code I have for my query:

   <cfquery name="qVerify" datasource="MyDSN">
SELECT  *
   FROM cryptuser
   WHERE firstname = '#firstname#'
   AND   password = '#password#'
</cfquery>

So a password entered and posted via form needs to be matched to a password encrypted in my table, does anyone know if this is possible?

Many thanks.

Answer 1

you would just need to encrypt the password entered by the user and then use that variable in your query.

<cfset EncryptedPassword = Encrypt(form.password,'your key','SHA-256')>

<cfquery name="qVerify" datasource="MyDSN">
SELECT  *
FROM cryptuser
WHERE firstname = <cfqueryparam cfsqltype="cf_sql_varchar" value="#firstname#">
AND   password = <cfqueryparam cfsqltype="cf_sql_varchar" value="#EncryptedPassword#">
</cfquery>