Comments on: Case sensitive comparisons in SQL

By: Sanjat

Sanjat — Tue, 14 Apr 2009 11:54:51 +0000

Check Password in sql
SELECT     U_Name, U_Print_Name, U_Code, U_Pass
FROM         M_USER
WHERE     (U_Name = 'v')  AND (CONVERT(varbinary(255), 'v') = CONVERT(varbinary(255), U_Pass))

By: Sanjat

Sanjat — Tue, 14 Apr 2009 11:53:26 +0000

SELECT     U_Name, U_Print_Name, U_Code, U_Pass
FROM         M_USER
WHERE     (U_Name = 'v')  AND (CONVERT(varbinary(255), 'v') = CONVERT(varbinary(255), U_Pass))

By: Lango

Lango — Tue, 27 May 2008 13:36:23 +0000

My suggestion would be to change your where clause to only compare user id and then do your password comparison after. Assuming your are doing this in stored procedure so you are not passing around passwords.

For example:

CREATE PROCEDURE [dbo].[AuthenticateUser]
(@UserName varchar(15),@Password varchar(15))AS
BEGIN
SET NOCOUNT ON
DECLARE @Result int –0: failed
–1: success
DECLARE @ActualPassword varchar(12)
SELECT @ActualPassword = [Password]
FROM MyUsers
WHERE Username = LTRIM(RTRIM(@UserName))
if @@RowCount>0
BEGIN
if convert(varbinary(255),@Password) = convert(varbinary(255),@ActualPassword)
select @Result = 1
END
return @Result;
END

By: Seb

Seb — Mon, 24 Sep 2007 13:34:23 +0000

“WHERE (L.UserID = @UserID) AND (L.[Password] = @Password)”

I have a stored proceudre that does a password check using WHERE statement (above), so isnt case sensitve. Would prefer not to do a non-case sensitive WHERE statement because of performance.

Do you have a method where after a the non-case sensitive WHERE statement is used, could then be followed by a case sensitive verification that it indeed matches?

By: Mark Kruger

Mark Kruger — Tue, 03 Jul 2007 16:24:12 +0000

Ryan,

that’s an outstanding tip. I love it.

-Mark