How to select a case sensitive value in SQL with C#

Question

Hello,
I have an application that at the begining a user will login with a user name and password which is stored in the database. The SQL statement is as follows:
"SELECT id_employee FROM employee WHERE employee_number='" + txtUserName.Text + "' AND passWord='" + txtPassword.Text + "'";
For testing purposes I have set the password to the word test.   The problem is, if the user enters in TEST or TeSt or TESt  it will grant them access. How do I set it to force the correct case?
I am using SQL 2005 for the database.
Thanks!
~zero

Answer 1

You can also set Collation while comparing strings:
"SELECT id_employee FROM employee WHERE employee_number='" + txtUserName.Text + "' COLLATE Latin1_General_CS_AS AND passWord='" + txtPassword.Text + "'  COLLATE Latin1_General_CS_AS";
All comments about not doing this type of quering using command string, instead of command with parameters, they are apsolutely right.
Nevertheless i will have only username as a parameter in the command and password will be return value from procedure. I will check for equality of entered password and returned one from command in C# code, and C# is case sensitive. There is a good security model implemented for password in AdventureWorks sample database for SQL Server 2005, in table Person.Contact.
That model use two fields for password, PasswordHash and PasswordSalt. PasswordSalt is randomly generated hash when password is modified and with that salt, password string is encrypted, which produce PasswordHash. So when you want to authenticate a user, execute a command that will return a row(PasswordHash and PasswordSalt) for entered username, and in application you will encrypt entered username with PasswordSalt. If generated string is equal with the one returned PasswordHash, then you have a valid login. If nothing is returned from command or they are not equal, you have invalid login.