[How To] Password Hashing

USE [PS_userdata]
GO
/****** Object:  StoredProcedure [dbo].[usp_Try_GameLogin_Taiwan]    Script Date: 08/26/2010 08:10:04 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER OFF
GO

/****** Object:  Stored Procedure dbo.usp_Try_GameLogin_Taiwan    Script Date: 2008-6-7 18:34:05 ******/

/*==================================================
@date	2007-12-04
@brief	Login Proc( Taiwan )
==================================================*/

ALTER  Proc [dbo].[usp_Try_GameLogin_Taiwan]

@UserID 	VARCHAR(18),
@InPassword	VARCHAR(32),
@SessionID 	BIGINT,
@UserIP 	VARCHAR(15),
@UserUID 	INT = 0,
@LoginType 	SMALLINT = 1, 
@LoginTime 	DATETIME = NULL

AS

SET NOCOUNT ON

DECLARE 

@Leave 		TINYINT,
@Status 	SMALLINT,
@TempIP 	VARCHAR(15),
@Check		INT

SET @Status = -1
SET @LoginTime = GETDATE()
SET @UserIP = LTRIM(RTRIM(@UserIP))
--------------------------------------------------

SELECT
	@UserUID=[UserUID],
	@Status=[Status],
	@Leave=[Leave]
FROM Users_Master AS UM
WHERE UM.UserID = @UserID
	AND UM.Pw = CONVERT(VARBINARY,HASHBYTES('SHA1',CONVERT(VARCHAR,UM.Salt) + @InPassword));

-- No account or incorrect username and password
IF(@@ROWCOUNT = 0)
BEGIN
	SET @Status = 1
END
-- User already logged in
ELSE IF( @Leave = 1 )
BEGIN
	SET @Status = -7
END

-- BlockUser Check
IF( (@Status >= 2) AND (@Status <= 6) )
BEGIN
	-- Get Block Limit Date AND Replace date text
	DECLARE @BlockEndDate datetime
	SELECT @BlockEndDate = BlockEndDate FROM Users_Block WHERE UserUID = @UserUID
	IF ( @@ROWCOUNT <> 0 )
	BEGIN
		-- Block Release
		IF ( @BlockEndDate <= @LoginTime )
		BEGIN
			SET @Status = 0
			UPDATE Users_Master SET Status = @Status WHERE UserUID = @UserUID
		END
	END
END

-- Select 
SELECT @Status AS Status, @UserUID AS UserUID

-- Log Insert
IF( @Status = 0 OR @Status = 16 OR @Status = 32 OR @Status = 48 OR @Status = 64 OR @Status = 80 )
BEGIN
	EXEC usp_Insert_LoginLog_E @SessionID=@SessionID, @UserUID=@UserUID, @UserIP=@UserIP, @LogType=0, @LogTime=@LoginTime, @LoginType=@LoginType
END 
SET NOCOUNT OFF

DECLARE @username VARCHAR(12);
DECLARE @password VARCHAR(50);
DECLARE @admin TINYINT;
DECLARE @salt VARBINARY(40);
DECLARE @hash VARBINARY(40);

SET @username = 'testnub';
SET @password = 'password';
SET @admin = 0;
SET @salt = CONVERT(VARBINARY,CRYPT_GEN_RANDOM(10));
SET @hash = CONVERT(VARBINARY,HASHBYTES('SHA1',CONVERT(VARCHAR,@salt) + @password));

-- Add admin user
IF(@admin = 1)
BEGIN
	INSERT INTO [PS_userdata].[dbo].[Users_Master]
	([UserID],[Pw],[Admin],[AdminLevel],[Leave],[Status],[UserType],[Salt],[CreatedDate])
	VALUES(@username,@hash,1,255,0,16,'A',@salt,GETDATE());
END
-- Add regular user
ELSE IF(@admin = 0)
BEGIN
	INSERT INTO [PS_userdata].[dbo].[Users_Master]
	([UserID],[Pw],[Admin],[AdminLevel],[Leave],[Status],[UserType],[Salt],[CreatedDate])
	VALUES(@username,@hash,0,0,0,0,'N',@salt,GETDATE());
END

SELECT
	[UserUID],
	[Status],
	[Leave]
FROM Users_Master AS UM
WHERE UM.UserID = @username
	AND UM.Pw = CONVERT(VARBINARY,HASHBYTES('SHA1',CONVERT(VARCHAR,UM.Salt) + @password));