How to retrieve sha1 hash values in mysql database for my java code

Question

I created function to authenticate user in java. I use SHA1 to encrypted data and I stored it in MySQL. Then I created parametric query to pass data from MySQL database.But I had an error in that query line. After I changed SHA1 values in database and I remove the SHA1 word in my query. Really it's work without any errors. But I want to get and check SHA1 encrypt data from database. How to pass database SHA1 encrypted data into my query. Please someone help me to solve my problem.

public boolean authenticate(String username, String password){
    Connection newConnection = null;
    ResultSet newRst = null;
    boolean flag = false; //return value which determines whether logged in or not
    String SqlString = "SELECT * FROM user"
            + " WHERE username=? AND password=SHA1(?)"; //Error line when use SHA1()

    String Username = username;
    String Password = password;

    String CheckUsername;
    String CheckPassword;

    List<String> ParametersDefined =
            Arrays.asList(Username, Password);
    List<String> ParametersNames =  Arrays.asList("username", "password");
    List<String> ParameterDataType =
            Arrays.asList("String", "String");

    DatabaseHandling newData = new DatabaseHandling();
    try {

        newConnection = newData.DataConnection();// creating the connection
        newRst = newData.DataReadArg(newConnection, SqlString,
                ParametersDefined, ParametersNames, ParameterDataType);
        //check whether one row or more 

        int RowCount = 0; // to find the row count
        while (newRst.next()) {
            //checking whether we are getting right row
            System.out.println("this is " + newRst.getString(2));

            RowCount++;
        }
        //if the Row count is one then it check    
        if (RowCount == 1) {
            newRst.first();
            CheckUsername = newRst.getString("username");
            CheckPassword = newRst.getString("password");

            if ((username.equals(CheckUsername))
                    && password.equals(CheckPassword)) {
                userRoleId = newRst.getInt("userRoleId");
                System.out.println("role = " + userRoleId);
                flag = true;
            }
        }

    } catch (Exception e) {

        System.out.println("Error" + e.getMessage());
        flag = false;

    }

    return flag;
}

Working line...

String SqlString = "SELECT * FROM user" + " WHERE username=? AND password=?"; //Without SHA1 String. It's working without any errors.

Pls share the exact error message you receive when you try to run the query with sha1() included. — Shadow
– Shadow, Commented Oct 13, 2016 at 9:41
I didn't receive any error message. But It's not working and not going to my system. — Nuwan Samarasinghe
– Nuwan Samarasinghe, Commented Oct 13, 2016 at 9:46
Then you probably do not secure the password using sha1() function. Btw, hash functions do not encrypt anything. Encryption can be reversed, hash cannot. — Shadow
– Shadow, Commented Oct 13, 2016 at 9:51
You misunderstood me: you should use hashing to protect passwords, just do not call it encryption. — Shadow
– Shadow, Commented Oct 13, 2016 at 10:00

Gunwant · Accepted Answer · 2016-10-13 09:54:08Z

3

You need to change your approach of fetching user data from database. Instead of “SELECT * FROM user WHERE username=? AND password=? “ Just use “SELECT * FROM user WHERE username=?” .

Fetch user based on user name only. Once user data is available, verify the encrypted password with database value.

This way you can isolate the below validations –

The user exists in the system by using unique value of “username”.
If user exists, verify password.

Cross verifying user credentials is very important business logic, it has to be in your business layer (your java service) and should not be spread across database.

answered Oct 13, 2016 at 9:54

Gunwant

1,0092 gold badges17 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to retrieve sha1 hash values in mysql database for my java code

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related