how to pass invalid password function

Viewed 10

I am using this function to show me invalid password when the user password does not matches but it always open encrypt decrypt function for me!

char username[50], pword[50]; struct user usr;

        printf("\nEnter your username:\t");
        takeinput(usr.username);
        printf("Enter your password:\t");
        takepassword();

        fp = fopen("Users.dat", "r");
        while (fread(&usr, sizeof(struct user), 1, fp))
        {
            if (strcmp(usr.username, username))
            {
                if (strcmp(usr.password, pword))
                {
                    system("cls");
                    printf("\n\t\t\t\t\t\tWelcome\n");
                    encrypt_decrypt();
                }
                else if ((!strcmp(usr.password, pword)))
                // if password is not matching with user password
                {
                    printf("\n\nInvalid Password!");
                }
               usrFound = 1;  
            }

           
        }
        if (!usrFound)
        {
            printf("\n\nUser is not registered!");
        }

        fclose(fp);
        break;
1 Answers

This is not a safe approach to store passwords, especially if it is only used to verify that a user knows the password. Instead of encryption, which can encrypt and decrypt a password, you should have a look at password-hash functions like Argon2, BCrypt or PBKDF2. Those functions generate an irreversible hash value, which can be used to check the password, but not to get the original password back.

Related