Hello,

I have a login page and I am storing the name of the users and their passwords in a database (I am using dsn to access and put data into the database). But I would like that these passwords were like ****** inside the databse. Does anyone know how I can do that?

Thanks in advance.
tcb.

I dont think there is an easy solution to that without using some sort of encryption.

Not sure what your level of experience is with asp, but this site offers a very good of an encryption method that will store the values in your database as unreadable. then you can use it to decrypt the text when it come back. Hopefully this helps and you can figure it out.

http://www.planet-source-code.com/vb...txtCodeId=6646

Here is an ASP.NET soloution:
http://www.sitepoint.com/article/sec...words-database

The principal would be the same for ASP, you may need to find an MD5 function from somewhere though cos ASP doesn't come with anything like that.

Or even better... switch to .NET

Anytime I'm working in ASP and need to encrypt something, I use XICE Encryption. You can get full source code in ASP for free at http://www.xice.net/sdkreg.asp

The method I use is to encrypt the password by itself, and store that in the database. Then to check to see if the user enters the correct password on a login form, I'll decrypt whatever is in the database with whatever they enter, and if it comes back as the same thing they entered (their password) then you know it's correct, otherwise you know it's wrong.

If the user forgets their password though, you'll have to have some sort of reset mechanism that resets their password to something random and emails it to them.

Anyway this method seems to provide the best security.

Reversable encryption has it's weaknesses in this application... if the same person who's snooping around in your DB has access to your sourcecode, then they can find the key and decrypt he passwords. Hashed passwords can't be decryped.

Thanks to everyone who posted. It really helped me.
I decided to use the RC4 algorithm and it it's very good, since you can encrypt and decrypt the data.

tcb