Home/ Questions/Q 7404623
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T05:16:52+00:00

I have an ASP.NET Web Application using SQL Server 2008. When a post code

  • 0

I have an ASP.NET Web Application using SQL Server 2008.

When a post code is submitted through the web application, it is encrypted, and then the encrypted value is sent to the database and inserted into a table.

I now need to find a way of querying these post codes from the web application by searching for parts of the post code like:

SELECT PostCode
FROM Table
WHERE PostCode LIKE @PostCode + '%'

How can I do this without storing a decryption function on the database? (Which I believe is bad for security?)

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    There are really only two options here.

    1. Encrypt the data you are submitting to your select query. That way you are comparing two different encrypted values. Of course, this will fail if you are using a salt..

    2. Don’t encrypt the values prior to storage. Instead, just save it normally. If it really does need to be encrypted, use the encryption methods available within SQL Server to automatically encrypt the column: http://msdn.microsoft.com/en-us/library/ms179331.aspx

    The purpose of your encryption is basically to protect information “at rest”. SQL server can do this by itself.

    • 0