从数据库检索盐

Question

我有一个与我的winforms程序相关的数据库。它存储名称，usertype，哈希和盐。我排序了注册和写作细节，但我不知道如何将盐（从数据库读取时）作为变量保存。这里是我的代码：

public string getSalt() 
    { 
     SqlConnection connection = new SqlConnection(@"server=.\SQLEXPRESS; database=loginsTest;Trusted_Connection=yes"); 
     connection.Open(); 
     string selection = "select DISTINCT Salt from Logins where Name = '"+userNameBox.Text+"'"; 
     SqlCommand command = new SqlCommand(selection, connection); 
     if (command.ExecuteScalar() != null) 
     { 
      connection.Close(); 
      return selection; 
     } 
     else 
     { 
      connection.Close(); 
      return "Error"; 
     } 
    } 

正如你可以看到，它的返回选项，即“+ userNameBox.Text +‘‘’从哪里登录名= SELECT DISTINCT盐’”。我如何将盐保存为要返回的变量？

Answer 1

这应该这样做，而且还修复了原有的鸿沟SQL注入漏洞：

public string getSalt() 
{ 
    string sql = "select DISTINCT Salt from Logins where Name = @username"; 

    using (var connection = new SqlConnection(@"server=.\SQLEXPRESS; database=loginsTest;Trusted_Connection=yes")) 
    using (var command = new SqlCommand(sql, connection)) 
    { 
     //guessing at the column length here. Use actual column size instead of 20 
     command.Parameters.Add("@username", SqlDbType.NVarChar, 20).Value = userNameBox.Text; 

     connection.Open(); 
     return (command.ExecuteScalar() as string) ?? "Error"; 
    } 
}