Question

Now I am just saving the password as it is

protected void Save_Click(object sender, EventArgs e)
    {

        string userName = Label13.Text;
        DateTime now = DateTime.Now;
        MySqlConnection connectionString = new MySqlConnection("Server=127.0.0.1;Database=surelyknown;Uid=root");
        connectionString.Open();
        MySqlDataAdapter adapter = new MySqlDataAdapter();
        MySqlCommand command = new MySqlCommand();
adapter.InsertCommand = new MySqlCommand("INSERT INTO tbl_user (FirstName,LastName,Email,U_Password,CompanyName,UserPermission,PhoneNumber,Created,Modified,Active,CreatedBy,tbl_organisation_OrganisationID) VALUES(@FirstName,@LastName,@Email,@U_Password,@CompanyName,@UserPermission,@PhoneNumber,@Created,@Modified,@Active,@CreatedBy,@tbl_organisation_OrganisationID)", connectionString);
    adapter.InsertCommand.Parameters.Add("@FirstName", MySqlDbType.VarChar).Value = FirstName.Text;
            adapter.InsertCommand.Parameters.Add("@LastName", MySqlDbType.VarChar).Value = Surname.Text;
            adapter.InsertCommand.Parameters.Add("@Email", MySqlDbType.VarChar).Value = Email.Text;
            adapter.InsertCommand.Parameters.Add("@U_Password", MySqlDbType.VarChar).Value = Password.Text;
            adapter.InsertCommand.Parameters.Add("@CompanyName", MySqlDbType.VarChar).Value = Convert.ToString(nID);

and when the user login to the website how can the encrypted password used to do authentication. i want to do the decryption in the server side itself. please help

Answer 1

First, you should salt and hash your passwords. When you say you want to do that on the server side, do you mean on the database server side, or the application server?