authenticating website users with mysql dbase

[Tontang Bei]

Im a newcomer to SQL. I have a web page where I am accepting a username and a password and then authenticating the user by checking if his username and password exists on the dbase. I am using the method below. but it alway returns false meaning that the username and password doesnt exists but in the Dbase I can clearly see that the particular user with the supplied username and password does exist. How can I rework or make changes in this code. What am I doing wrong?Thanks for all your help

 
public synchronized boolean isMatch(String username,String password) throws SQLException{
           boolean matched=false;
 String query = "SELECT UserName,Password FROM User " +
                       "WHERE UserName = \"username\"&&Password=\"password\"";
        Statement statement = connection.createStatement();
        ResultSet results = statement.executeQuery(query);
        matched=results.next();
results.close();
        statement.close();
 System.out.println(matched); <- always returning false. why?
   
return matched;
}
}

[Paul Sturrock]

Your query is this:

SELECT UserName,Password FROM User 
WHERE UserName = "username"&&Password="password""

Do you have any users with the username "username" and the password "password?

[Tontang Bei]

Ahhh...I see now..My mistake. thanks
[ May 03, 2007: Message edited by: Tontang Bei ]

[Tontang Bei]

I have modified the code to have correct sql. But now the method wont return anything. no true no false. What am I doing wrong? Thanks

    
public synchronized boolean isMatch(String username,String password) throws SQLException{
        System.out.println("definately being called"+username+password);
boolean matched=false;
String query = "SELECT UserName,Password FROM User WHERE UserName="+username+"&&"+"Password="+password;
        Statement statement = connection.createStatement();
        ResultSet results = statement.executeQuery(query);
        matched = results.next();
if(matched==true)
System.out.println("true");  <- no o/p
else
System.out.println("false");  <- no o/p
results.close();
        statement.close();
 System.out.println(matched);
   
return matched;
}
}

[Paul Sturrock]

My assumption would be that it is throwning a SQLException instead, since that is pretty much the only way could possible return nothing. How do you call the method? Are you handling the possible exception or are you throwing it away?

[Jan Cumps]

WHERE UserName="+username+"&&"+"Password="+password;

Shouldn't that be:

WHERE UserName=[B]'[/B]"+username+"[B]' and [/B]Password=[B]'[/B]"+password[B] + "'"[/B];

The result should look like this:

WHERE UserName='Tontang' and Password='jhy6354NJlk'

Regards, Jan

(have a look at PreparedStatement. It makes your code cleaner.)
(and have a look at container managed security. Your server will have user authentication functionality on board.)
[ May 03, 2007: Message edited by: Jan Cumps ]

[Tontang Bei]

These were the exceptions I was getting

  
java.lang.NullPointerException
        at data.DataMaster.isMatch(DataMaster.java:66)
        at data.LoginServlet.doGet(LoginServlet.java:20)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:690)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
        at org.apache.catalina.servlets.InvokerServlet.serveRequest(InvokerServl
et.java:402)
        at org.apache.catalina.servlets.InvokerServlet.doGet(InvokerServlet.java
:134)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:690)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:290)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:228)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:175)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:128)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:104)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:216)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java
:844)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.proce
ss(Http11Protocol.java:634)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:44
5)
        at java.lang.Thread.run(Thread.java:595)

This is the method I was using

    
public static synchronized boolean isMatch(String username,String password) throws SQLException{
        
   boolean matched=false;
   String preparedsql = "SELECT UserName,Password FROM User WHERE UserName=? and Password=?";
   PreparedStatement ps=connection.prepareStatement(preparedsql);
ps.setString(1,username);
ps.setString(2,password);
ResultSet results = ps.executeQuery();
        matched = results.next();
System.out.println(matched);
results.close();
                             ps.close();
 return matched;
 

This is how I was calling it

 
try{
 if (!(DataMaster.isMatch(userName,password))){ 
 }catch(Exception e){e.printStackTrace();}    
  

I got rid of all those exceptions by making the isMatch() method a NOn static. JDBC is proving to be a pain

[Jan Cumps]

JDBC is proving to be a pain

That error has nothing to do with JDBC. It's the code.

My guess:
You're using the static method isMatch(), which uses the static property connection.
And you might not have connected to the database when calling static isMatch(...).