Question

To improve the security for my users I wish to hide all user-passwords in my MSSQL database.
The webapplication is in ASP Classic and the SQL-field is a varchar(max).

I have heard about hashing the codes, but how does this work?
Is it something to be done in the SQL string or making an ASP function?

My current users tabel setup are:

id    username    password
1     jersey      plaintextpassword
2     timber      plaintextpassword
....

Answer 1

i prefer to store user password as with md5

save passwords after md5sum
when user trying to login

user variables from form

var_username = jersey
var_password = 123456

// dont forget to escape for sql injection
// generate md5sum for password
var_md5password = md5(password)

SELECT * FROM users WHERE username = 'var_username' AND password = 'var_md5password'

for example

|- id -|- username -|- password -|
|-  1 -|- jersey   -|- 123456   -|
|-  2 -|- timber   -|- 1234567  -|

table with md5

|- id -|- username -|-             password             -|
|-  1 -|- jersey   -|- e10adc3949ba59abbe56e057f20f883e -|
|-  2 -|- timber   -|- fcea920f7412b5da7be0cf42b8c93759 -|

more secure way

 secret_key = topsecretkey
 password: 123456
 md5(password+secretkey)
 it will generate a better md5