Forum:

Servlets

Login code problem

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

/*
 * LoginConnect.java
 *
 * Created on April 24, 2011, 2:07 AM
 */

import java.io.*;
import java.net.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;

/**
 *
 * @author Administrator
 * @version
 */
public class LoginConnect extends HttpServlet {
    
    /** Processes requests for both HTTP <code>GET</code> and <code>POST</code> methods.
     * @param request servlet request
     * @param response servlet response
     */
    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        
        String U_Name,Passwd;
        boolean connected;
         U_Name=request.getParameter("UserName").trim();
         Passwd=request.getParameter("Password").trim();
        
        
        PrintWriter out = response.getWriter();
         out.println("<html>");
        out.println("<head>");
        out.println("<title>Servlet LoginConnect</title>");
        out.println("</head>");
        out.println("<body>");
          try
        {
            String str= "select * from Customer where User_Name='"+U_Name+"' and Password_Name='"+Passwd+"'";
            Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
            Connection con=DriverManager.getConnection("jdbc:odbc:VirtualClassRoom","administrator","");
            Statement stmt=con.createStatement();
            ResultSet rs=stmt.executeQuery(str);
           
            while(rs.next())
            {
                
                String Data_Id,Dat_Passwd;
                Data_Id =rs.getString("User_Name");
                Dat_Passwd=rs.getString("Password_Name");
                
                if(Data_Id==U_Name && Dat_Passwd==Passwd) 
                {
                    connected=true;
                    out.println("<h1>Welcome" +Data_Id+ "</h1>");
                    out.println("Login Successful");
                     break;
                }
                else
                {
                    out.println("login failed");
                }
                
               
            }
       
        
            con.close();
        }
        
        catch(Exception e)
        {
            out.println(e);
        }
        
       
        
        out.println("</body>");
        out.println("</html>");
         
       // out.close();
        
      
        
    
         
         
         
          
    }
    
    // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
    /** Handles the HTTP <code>GET</code> method.
     * @param request servlet request
     * @param response servlet response
     */
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        processRequest(request, response);
    }
    
    /** Handles the HTTP <code>POST</code> method.
     * @param request servlet request
     * @param response servlet response
     */
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        processRequest(request, response);
    }
    
    /** Returns a short description of the servlet.
     */
    public String getServletInfo() {
        return "Short description";
    }
    // </editor-fold>
}

http://www.lifesbizzare.blogspot.com || OCJP:81%

Paul Sturrock

Bartender

Posts: 10336

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

You are not helping yourself writing code like this. The exception will include a stack trace that is full of helpful detail.

JavaRanch FAQ HowToAskQuestionsOnJavaRanch

Robin John

Ranch Hand

Posts: 281

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Line number 51 ->

why dont you try using "equals" String Equals

Time is what we want the most, but what we use the worst. -- William Penn

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Robin John wrote:Line number 51 ->

why dont you try using "equals" String Equals

Hi Robiin I used .equals(Data_Id) still same problem its showing me a blank page instead of displaying login successful

http://www.lifesbizzare.blogspot.com || OCJP:81%

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

When i changed the if loop it worked?? but it makes no sense??

http://www.lifesbizzare.blogspot.com || OCJP:81%

Prasad Krishnegowda

Ranch Hand

Posts: 672

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

You are closing the printwriter out on line 75. Just comment that line, it should work for you..

Robin John

Ranch Hand

Posts: 281

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

hmm interesting... did it work ?

closing the stream is a good practice... use flush before closing... Check Here

and I dont understand why do many use != and == for string operations even if it works sometimes (does it ?)....

Time is what we want the most, but what we use the worst. -- William Penn

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi Robin,

Nope it didnt work ..I also tried String1.equals(string2) still same problem.. I am not understanding where i am going wrong?

http://www.lifesbizzare.blogspot.com || OCJP:81%

Ulf Dittmer

Rancher

Posts: 43081

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Since you have made several changes to the code at this point, you should edit the first post with the code that you are now trying and which is still failing.

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi Ulf,

Edited the Code post

http://www.lifesbizzare.blogspot.com || OCJP:81%

Ulf Dittmer

Rancher

Posts: 43081

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

That code still uses the equality operator ("==") to compare strings. As was pointed out before, that is simply wrong.

Also be aware that the JDBC/ODBC bridge is not thread-safe, and that the code is vulnerable to SQL injection attacks.

Larry Chung

Ranch Hand

Posts: 247

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Vishal Hegde wrote:When i changed the if loop it worked?? but it makes no sense??
if(U_Name!=Data_Id && Passwd!=Dat_Passwd) { connected=true; out.println("<h1>Welcome" +Data_Id+ "</h1>"); out.println("Login Successful"); break; }

Vishal, of course (U_Name!=Data_Id && Passwd!=Dat_Passwd) will produce "Login Successful" because your ResultSet data very likely has instances when usernames and passwords do not match the entered username and password in the Request. Therefore the boolean logic in the "if" statement will be TRUE. What is the data in your Customer data table? For troubleshooting the problem, I suggest you change the "else" block to:

Then tell us what is your output.

SCJP 6

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

/*
 * LoginConnect.java
 *
 * Created on April 24, 2011, 2:07 AM
 */

import java.io.*;
import java.net.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;

/**
 *
 * @author Administrator
 * @version
 */
public class LoginConnect extends HttpServlet {
    
    /** Processes requests for both HTTP <code>GET</code> and <code>POST</code> methods.
     * @param request servlet request
     * @param response servlet response
     */
    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        
        String U_Name,Passwd;
        boolean connected;
         U_Name=request.getParameter("UserName").trim();
         Passwd=request.getParameter("Password").trim();
        
        
        PrintWriter out = response.getWriter();
         out.println("<html>");
        out.println("<head>");
        out.println("<title>Servlet LoginConnect</title>");
        out.println("</head>");
        out.println("<body>");
          try
        {
            String str= "select * from Customer where User_Name='"+U_Name+"' and Password_Name='"+Passwd+"'";
            Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
            Connection con=DriverManager.getConnection("jdbc:odbc:VirtualClassRoom","administrator","");
            Statement stmt=con.createStatement();
            ResultSet rs=stmt.executeQuery(str);
           
            if(rs.next())
            {
                
                String Data_Id,Dat_Passwd;
                Data_Id =rs.getString("User_Name");
                Dat_Passwd=rs.getString("Password_Name");
                
                if(Data_Id!=null&& Dat_Passwd!=null && U_Name.equals(Data_Id) && Passwd.equals(Dat_Passwd))
                {
                    connected=true;
                    out.println("<h1>Welcome" +Data_Id+ "</h1>");
                    out.println("Login Successful");
                    
                }
                else
                {
                    out.println("login failed"+U_Name);
                }
                
               
            }
       
        
            con.close();
        }
        
        catch(Exception e)
        {
            out.println(e);
        }
        
       
        
        out.println("</body>");
        out.println("</html>");
         
       out.close();
        
      
        
    
         
         
         
          
    }
    
    // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
    /** Handles the HTTP <code>GET</code> method.
     * @param request servlet request
     * @param response servlet response
     */
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        processRequest(request, response);
    }
    
    /** Handles the HTTP <code>POST</code> method.
     * @param request servlet request
     * @param response servlet response
     */
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        processRequest(request, response);
    }
    
    /** Returns a short description of the servlet.
     */
    public String getServletInfo() {
        return "Short description";
    }
    // </editor-fold>
}

Remade the code and still the same problem

Hi Larrry I inputted the variables in the else loop the values being displayed are correct.....I dont know why it is going to the else loop

Heres the simple login html page i used

<html>
  <head>
    <title></title>
  </head>
  <body>
<img src="http://www.logomaker.com/logo-images/5444cd11a05dae5c.gif"/>
<font face="verdana,arial" size=-1>
<left><table cellpadding=2 cellspacing=0 border=0>
<tr><td bgcolor="#f0e6d5"><table cellpadding=0 cellspacing=0 border=0 width=100%><tr><td bgcolor="blue" align=center style="padding:2;padding-bottom:4"><b><font size=-1 color="white" face="verdana,arial"><b>Enter your login and password</b></font></th></tr>
<tr><td bgcolor="white" style="padding:5"><br>
<form method="post" action="LoginConnect.do" name=pform>
<input type="hidden" name="action" value="login">
<input type="hidden" name="hide" value="">
<center><table>
<tr><td><font face="verdana,arial" size=-1>Login:</td><td><input type="text" name="UserName"></td></tr>
<tr><td><font face="verdana,arial" size=-1>Password:</td><td><input type="password" name="Password"></td></tr>
<tr><td><font face="verdana,arial" size=-1> </td><td><font face="verdana,arial" size=-1><input type="submit" value="Enter"></td></tr>
<tr><td colspan=2><font face="verdana,arial" size=-1> </td></tr>
<tr><td colspan=2><font face="verdana,arial" size=-1>Lost your username or password? Find it <a href="">here</a>!</td></tr>
<tr><td colspan=2><font face="verdana,arial" size=-1>Not member yet? Click <a href="">here</a> to register.</td></tr>
</table></center>
</form>
</td></tr></table></td></tr></table>
</td></tr></table></td></tr></table>

</body>
</html>

http://www.lifesbizzare.blogspot.com || OCJP:81%

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Larry Chung wrote:

Vishal Hegde wrote:When i changed the if loop it worked?? but it makes no sense??
if(U_Name!=Data_Id && Passwd!=Dat_Passwd) { connected=true; out.println("<h1>Welcome" +Data_Id+ "</h1>"); out.println("Login Successful"); break; }

Vishal, of course (U_Name!=Data_Id && Passwd!=Dat_Passwd) will produce "Login Successful" because your ResultSet data very likely has instances when usernames and passwords do not match the entered username and password in the Request. Therefore the boolean logic in the "if" statement will be TRUE. What is the data in your Customer data table? For troubleshooting the problem, I suggest you change the "else" block to:
else { out.println("login failed"); out.println("User name: " + U_Name + " " + Data_Id); out.println("Password: " + Passwd + " " + Dat_Passwd); }
Then tell us what is your output.

Hi Larry despite inputting the same login id and password as inputted in database still the code is flowing in the else loop

http://www.lifesbizzare.blogspot.com || OCJP:81%

Larry Chung

Ranch Hand

Posts: 247

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Vishal, please show me the output.

SCJP 6

Ulf Dittmer

Rancher

Posts: 43081

posted 13 years ago

1
Number of slices to send:

Optional 'thank-you' note:

Send

Make sure the DB query returns what you think it should return.

Rahul Manikuntla

Greenhorn

Posts: 11

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

So Vishal, what did you find out about the cause of the problem?

SCJP 5.0

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Rahul Manikuntla wrote:So Vishal, what did you find out about the cause of the problem?

Hi Rahul,

I still havent traced the root cause of the problem

Will sure update in this post once my problem is resolved

http://www.lifesbizzare.blogspot.com || OCJP:81%

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Larry Chung wrote:Vishal, please show me the output.

Database is like this

User_Name Password_Name

tiwarish demo@345

Also output is getting the same

http://www.lifesbizzare.blogspot.com || OCJP:81%

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

when i tried printing objec1.equals(Object2) it returned false. Should i try overridinng hashcode() or equals() method???

http://www.lifesbizzare.blogspot.com || OCJP:81%

Ulf Dittmer

Rancher

Posts: 43081

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Vishal Hegde wrote:Database is like this

User_Name Password_Name

tiwarish demo@345

Just to make sure: These two values are what is returned by the query? Note that I'm specifically not asking what is in the database - I'm asking whether that's returned by the query.

Should i try overridinng hashcode() or equals() method???

No.

I'd say the question is which of the 4 values in question is different from what you expect it to be. You should log them all if you haven't done so yet, so that you can check what their actual values are.

As another aside, the last code you posted is still vulnerable to SQL injections attacks. This is simply not acceptable, and you must fix it. The easiest way is to use a PreparedStatement. There are several other aspects in the code that should get fixed, but that's by far the most important one.

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi Ulf,

I am confident that you know what is the actual logical error , please let me know I have been struggling since afternoon...I promise alongwith time my programming logic will improvise

http://www.lifesbizzare.blogspot.com || OCJP:81%

Ulf Dittmer

Rancher

Posts: 43081

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

You'll learn much faster by trying things yourself. Debugging is an important skill for a developer to have, starting with simple things like the logging of relevant variable values.

PreparedStatement, on the other hand, is explained in its javadocs and in the JDBC trail of the Oracle Java Tutorial.

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Yay It worked trim() helped me out..

Thanks Ulf for making me aware of SQL Injection

http://www.lifesbizzare.blogspot.com || OCJP:81%

mallikarjun dontamsetti

Ranch Hand

Posts: 246

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Is your problem solved ?

May be it may help's you try it

Remove the quoted one

Vishal Hegde wrote: if(rs.next()) { String Data_Id,Dat_Passwd; Data_Id =rs.getString("User_Name"); Dat_Passwd=rs.getString("Password_Name"); if(Data_Id!=null&& Dat_Passwd!=null && U_Name.equals(Data_Id) && Passwd.equals(Dat_Passwd)) { connected=true; out.println("<h1>Welcome" +Data_Id+ "</h1>"); out.println("Login Successful"); } else { out.println("login failed"+U_Name); } }

Add the fallowing code

Use prepared statement it will be so easy

Vishal Hegde

Ranch Hand

Posts: 1087

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

mallikarjun don wrote:Is your problem solved ?

May be it may help's you try it

Remove the quoted one

Vishal Hegde wrote: if(rs.next()) { String Data_Id,Dat_Passwd; Data_Id =rs.getString("User_Name"); Dat_Passwd=rs.getString("Password_Name"); if(Data_Id!=null&& Dat_Passwd!=null && U_Name.equals(Data_Id) && Passwd.equals(Dat_Passwd)) { connected=true; out.println("<h1>Welcome" +Data_Id+ "</h1>"); out.println("Login Successful"); } else { out.println("login failed"+U_Name); } }

Add the fallowing code
if(rs.next(){ out.println("welcome"+U_Name+"<br/>"); //your success page code code } else{ //failure code }

Use prepared statement it will be so easy

Hi Mallikarjun,

Yes the problem is resolved i used the trim() function when retrieving data from the database and it resolved the problem

http://www.lifesbizzare.blogspot.com || OCJP:81%

What's a year in metric? Do you know this metric stuff tiny ad?

We need your help - Coderanch server fundraiser

https://coderanch.com/wiki/782867/Coderanch-server-fundraiser