title: c# validating a hashed password that's stored in an SQL database
body: <p>I have been stumped on this for quite a few hours now. I have been experimenting with creating a login form to a simple app I'm developing. </p>
  
  <p>I have successfully managed to salt/hash the passwords and upon creating a user account the login, hash and salt are all stored in separate columns of an SQL database table using an INSERT query.</p>
  
  <p>What I now need to do is take the password input from the user at the login page and combine that with the stored salt value, rehash the combined pw+salt and compare them to the stored hash value to validate the user. I am using a SELECT query to try to achieve this but so far have been unsuccessful. </p>
  
  <p>Here is my code: </p>
  
  <pre><code>///Gather the data from the SQL db, find the username, hash and salt values
          string ds = @"Data Source";
          using (SqlConnection con = new SqlConnection(ds))
          {
  
  ///define a set of strings for the query, the login textbox, password textbox and the Hash Gen Algorithm
              string query = "SELECT Login, Hash, Salt FROM [Table] WHERE (Login=@Login, Hash=@Hash, Salt=@Salt)";
              string uname = logTXT.Text;
              string passw = pwTXT.Text;
              string hash = GenHash(passw, "@salt");
  
              using (SqlCommand cmd = new SqlCommand(query, con))
              {
                  con.Open();
  
                  cmd.Parameters.AddWithValue("@Login", uname);
                  cmd.Parameters.AddWithValue("@Hash", hash);
  
                  cmd.Connection = con;
                  SqlDataReader dr = cmd.ExecuteReader();
  
                  if("@Hash" == hash)
                  {
                      MessageBox.Show("Login Successful");
                  }
                  else
                  {
                      MessageBox.Show("Login Failed");
                  }
  
  
              }
          }
  </code></pre>
  
  <p>I'm not sure how to make this happen successfully. </p>
  
  <p>My question is this: How can I take the value of the SQL column that stores the password salt, and then add it to the user password input from the textbox (pwTXT.Text + stored pw salt) so that I can put the result through my hashing algorithm and then compare the values to validate the user?</p>
  
  <p>EDIT: Thanks to Vlad Stryapko's answer I was able to get it working by using a slightly modified version and have successfully implemented the hashing algorithm and everything is working as it should. 
  So correct/most helpful answer should go to him. </p>
  
  <pre><code>string ds = @"Data Source";
  using (SqlConnection con = new SqlConnection(ds))
  {
  string query = "SELECT Salt FROM [Table] WHERE (Login=@Login)";
  string uname = logTXT.Text;              
  
  using (SqlCommand cmd = new SqlCommand(query, con))
  {
      con.Open();    
      cmd.Parameters.AddWithValue("@Login", uname);
      SqlDataReader dr = cmd.ExecuteReader();   
      string salt = null;
      if (dr.Read())
      {
          salt = dr.GetString(0);
      }    
  }
  </code></pre>