1

I have the following SQL Server Stored Procedure which validates a password.

ALTER PROC [dbo].[spValidatePassword]
@UserId uniqueidentifier,
@Password NVARCHAR(255)
AS
BEGIN

DECLARE @PasswordHash NVARCHAR(255) = HASHBYTES('SHA2_512', (SELECT @Password + CAST((SELECT p.PasswordSalt FROM Passwords p WHERE p.UserId =     @UserId) AS NVARCHAR(255))))

SELECT COUNT(*)
from Passwords
WHERE UserId = @UserId
AND [Password] = @PasswordHash


--return 1 if valid password
--return 0 if not valid

END

How can I return 1 from the stored procedure if the count is greater than zero, and zero otherwise?

5 Answers 5

3

Try this query, will return 1 if there is a result, else 0

SELECT (CASE WHEN COUNT(*) > 1 THEN 1 ELSE 0 END)
FROM Passwords
WHERE UserId = @UserId
AND [Password] = @PasswordHash
Sign up to request clarification or add additional context in comments.

3 Comments

and if there are 10 matching rows this select returns 10 rows of 1's
@Nick.McDermaid, No, Never, u can try COUNT in a simple table with a WHERE clause.
Oh! Interesting I never knew that. I take it back.
2
ALTER PROC [dbo].[spValidatePassword]
@UserId uniqueidentifier,
@Password NVARCHAR(255)
AS
BEGIN

DECLARE @PasswordHash NVARCHAR(255) = HASHBYTES('SHA2_512', (SELECT @Password + CAST((SELECT p.PasswordSalt FROM Passwords p WHERE p.UserId =     @UserId) AS NVARCHAR(255))))

SELECT 
CASE WHEN EXISTS (
         SELECT *
         from Passwords
         WHERE UserId = @UserId
         AND [Password] = @PasswordHash
         )
 THEN 1 
 ELSE 0
 END


--return 1 if valid password
--return 0 if not valid

END

But consider using some other authentication model like OAuth or Office 365 logins rather than reinventing the wheel

1 Comment

Thanks Nick. The authentication is using OWIN but it is against a legacy database.
0
IF    (SELECT COUNT(UserId) from Passwords WHERE UserId = @UserId  AND [Password] = @PasswordHash) > 0
begin
    return 1;
End
ELse
begin
   return 0;
end

this query will return the required result

4 Comments

No. If there are 3 matching records this will return 3. The result is no different to COUNT(*)
check modified answer
OK so now this one returns data using RETURN rather than SELECT
you can use select 1 in place of return 1
0
IF EXISTS (
         SELECT *
         from Passwords
         WHERE UserId = @UserId
         AND [Password] = @PasswordHash
         )
RETURN 1;
ELSE
RETURN 0;

Comments

0

You can also use OUTPUT Type stored procedure to get a scalar (in your case either 1 or 0) result as:

ALTER PROC [dbo].[spValidatePassword]
@UserId uniqueidentifier,
@Password NVARCHAR(255),
@result TINYINT OUTPUT
AS
BEGIN

DECLARE @PasswordHash NVARCHAR(255) = HASHBYTES('SHA2_512', (SELECT @Password + CAST((SELECT p.PasswordSalt FROM Passwords p WHERE p.UserId =     @UserId) AS NVARCHAR(255))))

SELECT @result = COUNT(*)
from Passwords
WHERE UserId = @UserId
AND [Password] = @PasswordHash

END

You can execute this proc as:

DECLARE @output TINYINT

EXEC [dbo].[spValidatePassword]  @UserId= 'any user id',@Password = 'any password',@result = @output OUTPUT

PRINT @output

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.