Question

I’m trying to do a very simple username and password validation against a table called users (containinig an id(int) username(nchar(10)) and password(char(32)) using Razor but I’m encountering this error:

Operator '==' cannot be applied to operands of type 'WebMatrix.Data.DynamicRecord' and 'HasherMD5Main'

I created a .cs class that does an md5 hash (HasherMD5Main) which returns the value passed as a string (please no comments on security, this is not going into any production environments) and I’m hashing the entered password and then doing a lookup in the db.

Code

@{// Initialize page
    var enteredusername = "";
    var enteredpassword = "";
    var ErrorMessage = "";

    // If this is a POST request, validate and process data
    if( IsPost ) {
        enteredusername = Request.Form["enteredusername"];
        enteredpassword = Request.Form["enteredpassword"];
        var hash = new HasherMD5Main( enteredpassword );
        if( enteredusername.IsEmpty() || enteredpassword.IsEmpty() ) {
            ErrorMessage = "You must specify a username and password.";
        }
        else {
            var db = Database.Open( "MyConnectionString" );
            var passwordquery = db.QuerySingle( "SELECT password FROM users WHERE username = @0", enteredusername );
            if( passwordquery == hash ) {
                Response.Redirect( "/Success" );
            }
            else {
                Response.Redirect( "/Failure" );
            }

        }
    }
}

@if( ErrorMessage != "" ) {
    <p>@ErrorMessage</p>
    <p>Please correct the errors and try again.</p>
}

<form method="post" action="">
    <fieldset>
        <legend>Log In to Your Account</legend>
        <ol>
            <li>
                <label>Username:</label>
                <input type="text" id="enteredusername" name="enteredusername" />
            </li>
            <li>
                <label>Password:</label>
                <input type="password" id="enteredpassword" name="enteredpassword" />
            </li>
            <li>
                <p>
                    <input type="submit" value="login" /></p>
            </li>
        </ol>
    </fieldset>
</form>

Any ideas on how I can simply validate if the hashed password my app comes up with matches the hash stored in the db?

Answer 1

The line that produces the error is:

if (passwordquery == hash)

hash is your custom Md5 hasher instance

var hash = new HasherMD5Main(enteredpassword);

while passwordquery is a resultset from the database query WebMatrix.Data.DynamicRecord

var passwordquery = db.QuerySingle(“SELECT password FROM users WHERE username = @0”, enteredusername );

What you want to do is to have your MD5 hasher calculate the hash and then compare it to the result value you can extract form the resultset.