Question

The code below allows a user to enter user name and password to log in to enter marks of students. SQL data reader verifies the user credentials from the database before authentication takes place. I would be grateful if someone could modify the code by salting and hashing the password.

Dim frm As New MarksEntryFrm
    Dim flag As Boolean
    flag = False
    If cboForm.Text = "" Or cboAcadYear.Text = "" Or cboSubjCode.Text = "" Or txtUserName.Text = "" Or txtPassword.Text = "" Then
        MessageBox.Show("Please any of the fields cannot be left blank", "Blank fields", MessageBoxButtons.OK, MessageBoxIcon.Error)
    Else
        cmd = New SqlCommand("Select a.Form,a.AcademicYear,b.SubjectID,b.UserID,b.Password,c.Term from StudentDetails.Programmes a, StudentDetails.Subjects b,RegistrationDetails.Registration c where b.SubjectID='" & cboSubjCode.SelectedItem & "' and b.UserID='" & txtUserName.Text & "' and b.Password='" & txtPassword.Text & "' collate Latin1_General_CS_AS", cn)
        cmd.Parameters.AddWithValue("@UserID", txtUserName.Text) 'protects the database from SQL Injection
        cmd.Parameters.AddWithValue("@Password", txtPassword.Text) 'protects the database from SQL Injection

        dr1 = cmd.ExecuteReader
        ctr = ctr + 1
        If dr1.Read Then
            frm.Show()
            ctr = 0
            Hide()
        ElseIf ctr < 3 Then
            MessageBox.Show("Incorrect Subject Code,User Name or Password. Please try again.", "Wrong data entered", MessageBoxButtons.OK, MessageBoxIcon.Asterisk)
        Else
            MsgBox("Unathorized access. Aborting...")
            Close()
        End If
        dr1.Close()
    End If
End Sub

Answer 1

P.S. Akaglo, a better way to check if any fields were left empty is to use the String.IsNullOrEmpty() method. Your method will not detect any null or space characters.