How to compare Entering Password with existing encrypted pasword in APEX4.1

Question

Hello everyone,
In my application am using the following package,
create or replace PACKAGE BODY app_security_pkg
AS
PROCEDURE login
           p_uname IN VARCHAR2
          ,p_password IN VARCHAR2
          ,p_session_id IN VARCHAR2
          ,p_flow_page IN VARCHAR2
IS
lv_goto_page NUMBER DEFAULT 1;
BEGIN
-- This logic is a demonstration of how to redirect
-- to different pages depending on who successfully
-- authenticates. In my example, it simply demonstrates
-- the ADMIN user going to page 1 and all other users going
-- to page 2. Add you own logic here to detrmin which page
-- a user should be directed to post authentication.
IF UPPER(p_uname) = 'ADMIN'
THEN
  lv_goto_page := 1;
ELSE
  lv_goto_page := 2;
END IF;
APEX_UTIL.SET_SESSION_STATE('FSP_AFTER_LOGIN_URL');
wwv_flow_custom_auth_std.login
  p_uname => p_uname,
  p_password => p_password,
  p_session_id => p_session_id,
  p_flow_page => p_flow_page || ':' || lv_goto_page
EXCEPTION
WHEN OTHERS
THEN
RAISE;
END login;
PROCEDURE add_user
p_username IN VARCHAR2
,p_password IN VARCHAR2
AS
BEGIN
INSERT INTO app_users (username, PASSWORD)
    VALUES (UPPER (p_username),
        get_hash (TRIM (p_username), p_password));
COMMIT;
EXCEPTION
WHEN OTHERS
THEN
ROLLBACK;
RAISE;
END add_user;
-- Function to Perform a oneway hash of the users
-- passwords. This cannot be reversed. This exmaple
-- is a very week hash and if been used on a production
-- system, you may want to use a stronger hash algorithm.
-- Read the Documentation for more info on DBMS_CRYPTO as
-- this is the supported package from Oracle and
-- DBMS_OBFUSCATION_TOOLKIT is now depricated.
FUNCTION get_hash (p_username IN VARCHAR2, p_password IN VARCHAR2)
RETURN VARCHAR2
AS
BEGIN
RETURN DBMS_OBFUSCATION_TOOLKIT.md5 (
input_string => UPPER (p_username)
                || '/'
                || UPPER (p_password));
END get_hash;
PROCEDURE valid_user2 (p_username IN VARCHAR2, p_password IN VARCHAR2)
AS
v_dummy VARCHAR2 (1);
BEGIN
SELECT '1'
INTO v_dummy
FROM app_users
WHERE UPPER (username) = UPPER (p_username)
AND PASSWORD = get_hash (p_username, p_password);
EXCEPTION
WHEN NO_DATA_FOUND
THEN raise_application_error (-20000, 'Invalid username / password.');
END valid_user2;
FUNCTION valid_user (p_username IN VARCHAR2, p_password IN VARCHAR2)
RETURN BOOLEAN
AS
BEGIN
valid_user2 (UPPER (p_username), p_password);
RETURN TRUE;
EXCEPTION
WHEN OTHERS
THEN RETURN FALSE;
END valid_user;
END app_security_pkg;Here the ADD_USER Procedure will convert the password and stores into the app_users Table in encrypted form.
In my application the users can change their password,
so I need to compare the entering password in the Current_password field with the Encrypted password in the app_users table,
so I used the following code,
declare
  l_x varchar2(30);
begin
  select username into l_x
        from app_users
    where upper(username) = upper(:P7_USERNAME)
      and password = :P7_CURRENT_PASSWORD;
  return (true);
exception
  when no_data_found then
    return (false);
end;This code is working fine when the password is stored without encryption,but after encryption it showing error,
because the entering password is simply password and not encrypted so both are different even if the user enters right password,
Please tel me how to encrypt the entering password to compare with existing encrypted password.
Thank you,
Regards,
gurujothi.

Answer 1

Dear Sunil and vdotcherukuri     ,
Thank you for your reply as per your suggestion I tried the following code and its working fine.
declare
  l_x varchar2(30);
begin
  select username into l_x
        from app_users
    where upper(username) = upper(:P7_USERNAME)
      and password = app_security_pkg.get_hash (TRIM (:p7_username), :P7_CURRENT_PASSWORD);
  return (true);
exception
  when no_data_found then
    return (false);
end;Thank you,
Regards,
Gurujothi.