Insert String value into Database C#

Question

I've got my passwords to be hashed in my ASP.NET Webforms.

How do I then enter the hashed password into the database via a string?

SqlConnection dbCon = new SqlConnection(ConfigurationManager.ConnectionStrings["ConMotorstore"].ConnectionString);

dbCon.Open();

SqlCommand cmd = new SqlCommand("INSERT INTO [user] VALUES (@firstName, @surname, @email, @username, @passwordHash)", dbCon);

cmd.Parameters.AddWithValue("firstName", firstNameTxt.Text);
cmd.Parameters.AddWithValue("surname", surnameTxt.Text);
cmd.Parameters.AddWithValue("email", emailTxt.Text);
cmd.Parameters.AddWithValue("username", usernameTxt.Text);

string passwordHash = BCrypt.Net.BCrypt.HashPassword(passwordTxt.Text);
cmd.Parameters.ToString("passwordHash");

cmd.ExecuteNonQuery();

I knew I couldn't use .AddWithValue and thought of .ToString may have been the one to use.

I am new to C#.

Thanks.

"I knew I couldn't use .AddWithValue " Why did you think that? — user47589
– user47589, Commented Jun 1, 2017 at 14:38
As a side note, you should be wrapping your SqlConnection and SqlCommand statements in using blocks. — Icemanind
– Icemanind, Commented Jun 1, 2017 at 14:39
if you just hash your password to a string and want to store that string, you can indeed just use AddWithValue. What you're doing up there cmd.Parameters.ToString("passwordHash") will not accomplish much, because the ToString() method just returns a (formatted) string and doesn't do any assignment internally, besides it will try to take "passwordHash" as the format string wich doesn't make much sense. — Adwaenyth
– Adwaenyth, Commented Jun 1, 2017 at 14:41
What is the problem with cmd.Parameters.AddWithValue("passwordHash", passwordHash);? — Amit Joshi
– Amit Joshi, Commented Jun 1, 2017 at 14:45

mjwills · Accepted Answer · 2017-06-01 14:37:49Z

3

Does this work?

   SqlConnection dbCon = new SqlConnection(ConfigurationManager.ConnectionStrings["ConMotorstore"].ConnectionString);
{
    dbCon.Open();
    SqlCommand cmd = new SqlCommand("INSERT INTO [user] VALUES (@firstName,@surname,@email,@username,@passwordHash)", dbCon);
    cmd.Parameters.AddWithValue("firstName", firstNameTxt.Text);
    cmd.Parameters.AddWithValue("surname", surnameTxt.Text);
    cmd.Parameters.AddWithValue("email", emailTxt.Text);
    cmd.Parameters.AddWithValue("username", usernameTxt.Text);
    string passwordHash = BCrypt.Net.BCrypt.HashPassword(passwordTxt.Text);
    cmd.Parameters.AddWithValue("passwordHash", passwordHash);


    cmd.ExecuteNonQuery();

answered Jun 1, 2017 at 14:37

mjwills

24.1k6 gold badges45 silver badges74 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

JackH Over a year ago

Thanks @mjwills! Works fine, never thought of trying that.

Collectives™ on Stack Overflow

Insert String value into Database C#

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related