(cross posted from the SQL forum where I couldnt get an answer. Maybe this is the right place)
Hi everyone,
I'm working on a new database and MVC website for our client. Their legacy database stored user passwords in clear text and I'm looking to change that practice in our new system.
I've set up our new User create and edit forms to use MD5 hashing with Unicode to produce a hash, and everything seems OK (even though when I view the nvarchar(50) passwordHash field in the DB it looks like a lot of grabage "?]G??1?c??|??G??". But my main problem is this: I need to migrate all of the existing users to the new database, and to achieve this I'd prefer to use a stored procedure and HashBytes. But when I test out HashBytes with MD5 I get a hash that looks nothing like what I'm generating in .Net's Crypto provider.
So, for example, in .Net with MD5 I get this:
"?]G??1?c??|??G??"
But in SQL 2008's HashBytes I get something like this:
0 ...
Go to the complete details ...