I learned about storing password in SQL server database with HASHING and Salt. This code was online and had no really useful comment section for it so I want to ask here.
Why is #salt cast as NVARCHAR(36) here?
I tried different lengths like NVARCHAR(50) and in the database, Salt is still saved as a string of length 36.
For example:
B25243D7-A126-48A8-90F2-5898572F54D2
E29E1CEF-DBE1-4373-9510-A911BA0C8672
CREATE TABLE dbo.[User1]
(
UserID INT IDENTITY(1,1) NOT NULL,
LoginName NVARCHAR(40) NOT NULL,
PasswordHash BINARY(64) NOT NULL,
Salt UNIQUEIDENTIFIER,
FirstName NVARCHAR(40) NULL,
LastName NVARCHAR(40) NULL,
CONSTRAINT [PK1_User_UserID] PRIMARY KEY CLUSTERED (UserID ASC)
)
CREATE PROCEDURE dbo.uspAddUser1
#pLogin NVARCHAR(50),
#pPassword NVARCHAR(50),
#pFirstName NVARCHAR(40) = NULL,
#pLastName NVARCHAR(40) = NULL,
#responseMessage NVARCHAR(250) OUTPUT
AS
BEGIN
SET NOCOUNT ON
DECLARE #salt UNIQUEIDENTIFIER=NEWID()
BEGIN TRY
INSERT INTO dbo.[User1] (LoginName, PasswordHash, Salt, FirstName, LastName)
VALUES(#pLogin, HASHBYTES('SHA2_512', #pPassword+CAST(#salt AS NVARCHAR(36))), #salt, #pFirstName, #pLastName)
SET #responseMessage = 'Success'
END TRY
BEGIN CATCH
SET #responseMessage = ERROR_MESSAGE()
END CATCH
END
DECLARE #responseMessage NVARCHAR(250)
EXEC [dbo].[uspAddUser1]
#pLogin = 'admin2',
#pPassword = '123456',
#pFirstName = 'John',
#pLastName = 'Smith',
#responseMessage = #responseMessage OUTPUT
SELECT * FROM [dbo].[User1]
It is because of DECLARE #salt UNIQUEIDENTIFIER=NEWID(). in sql server NEWID() function returns a UNIQUEIDENTIFIER of character length 36
Related
I'm new to SQL and I'm stuck. If anyone could please help me out.
I have a stored procedure modifyMobileNo to change a mobile number, where ID and MobileNo are the parameters. Change Sarah Furgerson's number to 3246568413
Table columns:
ID INT NOT NULL
FirstName NVARCHAR(20) NOT NULL
LastName NVARCHAR(20) NOT NULL
HouseUnitLotNum NVARCHAR(5) NOT NULL
Street NVARCHAR(50) NOT NULL
Suburb NVARCHAR(50) NOT NULL
State NVARCHAR(3) NOT NULL
PostCode NCHAR(4) NOT NULL
MobileNo NCHAR(10) NULL
DateOfBirth DATE NOT NULL
Gender NCHAR(10) NOT NULL
Ref NVARCHAR(4) NOT NULL
CREATE PROCEDURE modifyMobileNo #ID INT, #MobileNo NCHAR(10)
AS
SELECT ID, Firstname, LastName, MobileNo
FROM Table
WHERE ID = #ID AND MobileNo = #MobilePNo
BEGIN
Do I need to add more parameters? Sorry, so confused.
Not sure where to start.
BEGIN
SET NOCOUNT ON;
UPDATE Table
SET ID = #ID,
MobileNo = #MobileNo
WHERE
FirstName = #FirstName
AND LastName = #LastName
END
seems like it should be something simple like -
CREATE PROCEDURE modifyMobileNo #ID INT, #MobileNo NCHAR(10)
AS
BEGIN
UPDATE Table
SET MobileNo = #MobileNo
WHERE ID = #ID
END
Can someone please explain why this trigger would start failing and insert the same record repeatedly? It seems as though there is something wrong with the variables. The purpose of the trigger is to copy the inserted record from the Employee table to the EmployeeHistory table. I set the trigger and it runs fine. But then when my coworker runs some insert scripts, it starts repeating the same old value from my last execution of an insert, instead of the new values that they are trying to insert.
I have already recoded this to not use variables, but I would still like to know why this doesn't work as expected.
CREATE TRIGGER [dbo].[triggerEmployee_AfterInsert]
ON [dbo].[Employee]
AFTER INSERT
AS
BEGIN
SET NOCOUNT ON;
DECLARE #EmployeeID varchar(25)
DECLARE #FirstName varchar(25)
DECLARE #LastName varchar(50)
DECLARE #FullName varchar(75)
DECLARE #EmailAddress varchar(50)
DECLARE #ManagerID varchar(15)
DECLARE #JobTitle varchar(50)
DECLARE #EmployeeStatus varchar(10)
DECLARE #Office varchar(25)
SELECT #EmployeeID = [dbo].[Employee].[EmployeeID]
,#FirstName = [dbo].[Employee].[FirstName]
,#LastName = [dbo].[Employee].[LastName]
,#FullName = [dbo].[Employee].[FullName]
,#EmailAddress = [dbo].[Employee].[EmailAddress]
,#ManagerID = [dbo].[Employee].[ManagerID]
,#JobTitle = [dbo].[Employee].[JobTitle]
,#EmployeeStatus = [dbo].[Employee].[EmployeeStatus]
,#Office = [dbo].[Employee].[Office]
FROM [dbo].[Employee]
INSERT INTO [dbo].[EmployeeHistory] (
EmployeeID
,FirstName
,LastName
,FullName
,EmailAddress
,ManagerID
,JobTitle
,EmployeeStatus
,Office
)
VALUES (
#EmployeeID
,#FirstName
,#LastName
,#FullName
,#EmailAddress
,#ManagerID
,#JobTitle
,#EmployeeStatus
,#Office
)
END
GO
ALTER TABLE [dbo].[Employee] ENABLE TRIGGER [triggerEmployee_AfterInsert]
GO
Rewriting the SELECT statement to use the INSERTED table fixed the issue.
SELECT #EmployeeID = [EmployeeID]
,#FirstName = [FirstName]
,#LastName = [LastName]
,#FullName = [FullName]
,#EmailAddress = [EmailAddress]
,#ManagerID = [ManagerID]
,#JobTitle = [JobTitle]
,#EmployeeStatus = [EmployeeStatus]
,#Office = [Office]
FROM INSERTED
I wrote a stored procedure which uses encryption algorithm to insert a row into a table. The procedure is executing successfully, but no row is added.
My code:
CREATE TABLE dbo.[User]
(
UserID INT IDENTITY(1,1) NOT NULL,
Email NVARCHAR(64) NOT NULL,
PasswordHash BINARY(64) NOT NULL,
FirstName NVARCHAR(40) NULL,
LastName NVARCHAR(40) NULL,
CONSTRAINT [PK_User_UserID] PRIMARY KEY CLUSTERED (UserID ASC)
)
CREATE PROCEDURE dbo.addUser
#pEmail NVARCHAR(64),
#pPassword NVARCHAR(64),
#pFirstName NVARCHAR(40) = NULL,
#pLastName NVARCHAR(40) = NULL,
#responseMessage NVARCHAR(250) OUTPUT
AS
BEGIN
BEGIN TRY
INSERT INTO dbo.[User] (Email, PasswordHash, FirstName, LastName)
VALUES(#pEmail, HASHBYTES('SHA2_512', #pPassword), #pFirstName, #pLastName)
SET #responseMessage = 'Success'
END TRY
BEGIN CATCH
SET #responseMessage = ERROR_MESSAGE()
END CATCH
END
DECLARE #responseMessage NVARCHAR(250)
EXEC dbo.addUser
#pEmail = 'Admin',
#pPassword = '123',
#pFirstName = 'Admin',
#pLastName = 'Administrator',
#responseMessage=#responseMessage OUTPUT
After executing the procedure, no rows have been added to the table.
My stored procedure is
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
ALTER PROCEDURE [dbo].[Customer_Registrations]
#type varchar(50) = null,
#Customer_ID int = null,
#Customer_Name varchar(50) = null,
#Email varchar(50) = null,
#Password varchar(50) = null,
#Mobile varchar(50) = null
AS
BEGIN
SET NOCOUNT ON;
IF #type = 'select'
BEGIN
SELECT *
FROM ssshub..Customer_Master
END
IF #type = 'specific'
BEGIN
SELECT *
FROM ssshub..Customer_Master
WHERE Customer_ID = #Customer_ID
END
IF #type = 'insert'
BEGIN
INSERT INTO [dbo].[Customer_Master]([Customer_Name], [Email],[Password], [Mobile], [SDate])
VALUES ('#Customer_Name', '#Email', '#Password', '#Mobile', CURRENT_TIMESTAMP)
END
END
And my table
This is working fine
This query works fine but when I am trying to insert it using stored procedure it throws an error.
I have an identity specification for customer_id on so no need to insert it
INSERT INTO [dbo].[Customer_Master] ([Customer_Name], [Email], [Password], [Mobile], [SDate])
VALUES('ewcewc', 'dewdw#dwc.com', 'dewdwd', '9999999999', CURRENT_TIMESTAMP)
Now when I am trying to execute my stored procedure with the following statement
exec customer_registrations 'insert', 'dsad', 'test#test.com', 'pass', '9999900000'
I get:
Error converting data type varchar to int
Lining up your arguments with the parameters:
'insert' -> #type varchar(50)
'dsad' -> #Customer_ID int
'test#test.com' -> #Customer_Name varchar(50)
'pass' -> #Email varchar(50)
'9999900000' -> #Password varchar(50)
-> #Mobile varchar(50) = null
...you can see that 'dsad' has no way of being understood as an int. Maybe there's a problem elsewhere as well, but at the very least, the stored procedure is not being called correctly.
Update:
If your intent was to omit some arguments that aren't relevant in a certain case, you have to use named parameters; otherwise, arguments can only be applied in the same order the parameters appear:
exec customer_registrations
'insert',
#Customer_Name = 'dsad',
#Email = 'test#test.com',
#Password = 'pass',
#Mobile = '9999900000';
Please pass null value in procedure while you insert the data in table. Run the procedure below way while inserting data in table. you should me manage all the parameter of procedure. you are not passed value of Customer_ID, so that's way error occur.
EXEC [dbo].[Customer_Registrations] 'insert',null,'ewcewc', 'dewdw#dwc.com', 'dewdwd', '9999999999'
Create Database Test
Create Table Employee
(
EmpId int identity(1,1) not null primary Key,
EmpName varchar(50),
Address varchar(50),
MobileNo int
)
Select * From [dbo].[Employee]
Alter Table [dbo].[Employee] Alter Column MobileNo Bigint
Insert into [dbo].[Employee] values('Harsh Kumar','Banglore','9748342075')
Create Proc MyProc
As
Select * From [dbo].[Employee]
EXEC MyProc
Create Proc SP_GetEmp
#EmpId int,
#EmpName varchar(50),
#Address varchar(50),
#MobileNo int
As
Insert into [dbo].[Employee](EmpId, EmpName, Address, MobileNo) Values(#EmpId, #EmpName, #Address, #MobileNo)
EXEC SP_GetEmp 'Rahul Kr','Pune', 8250707544
EXEC MyProc
Error:- Error converting data type varchar to int.
It returns null, why? The IDENT_CURRENT part but it works well with Scope_Identity, why ?
ALTER PROCEDURE [dbo]. [InsertComplaints]
#ComplaintCode varchar(50),
#ComplaintType_ID smallint,
#RecievingMode_ID smallint,
#Subject varchar(100),
#ComplainantID smallint,
#District_ID smallint,
#AddressedTo varchar(50),
#DiaryNo varchar(50),
#User_ID int,
#Status_ID smallint,
#RecievedDate smalldatetime,
#IGRemarks varchar(MAX) = null,
#PsoRemarks varchar(MAX) =null,
#FinalDecision varchar(250)=null,
#AgainstDist_ID smallint,
#HomePS_ID smallint,
#AgainstPS_ID smallint,
#Name varchar(75),
#DesigID int,
#ForwardedBy smallint,
#SMS_ID int = 0,
#result bit output,
#ID int output
AS
BEGIN
Begin Try
insert into dbo.Complaints
values (
#ComplaintCode,
#ComplaintType_ID,
#RecievingMode_ID ,
#Subject,
#ComplainantID ,
#District_ID ,
#AddressedTo ,
#DiaryNo,
#User_ID,
#Status_ID,
#RecievedDate,
#IGRemarks,
#PsoRemarks,
#FinalDecision,
#AgainstDist_ID,
#HomePS_ID,
#AgainstPS_ID,
#Name ,
#DesigID,
#ForwardedBy,
#SMS_ID
)
Set #result = ##ROWCOUNT
Set #ID = IDENT_CURRENT('ComplaintID') --SCOPE_IDENTITY()
Select #ID
End Try
Begin Catch
Set #result=0
End Catch
END
I want to get a last inserted id from particular table such that complaintID from complaints table but it doesn't return any but null. Help !
According to msdn the IDENT_CURRENT function will return null if the calling user does not have enough permissions on this object.
Another possibility is that your object name is wrong, i see you're doing your insert with the dbo prefix. Maybe that will help.