SQL security check 1

[selinis]

Hi!

context:
an user fills an "user name" and a "password" field in a html page.
IN my SQL Server I have defined a login named "test" with "some_password" password. This login is "SQL Server Authentication" type.

I have a "check_user.asp" page which is dealing with conections,recordsets,etc.

problem:
SQL Server stores the passwords as encrypted binary data. I wanted to use for query a view named "syslogins" from master database.The same situation can be found in my database in a table named "sysusers".Do you know if there is a method to compare the password inputed by user in the html page with "password" field from view(table) above?
If there is another solution for checking if a user exists in SQL Server please post it here.Maybe I'm missing it now..

thank you!

 

[JamesLean]

There's no way to read the passwords from the SQL Server tables (imagine the security risks!!!)

I suggest you make a table in SQL Server to store the users/passwords for your site and use one login when connecting to the DB from your application. You can then restrict access to certain parts of your site, depending on what login they use, in your code. --James