Issue with jsp login from Mysql database

Question

Been playing around with thing's I've found over the weeks and I've decided to put together a little java web application where you are required to login. The login details are taken from a mysql database. This is all done through netbeans. I've added the mysql driver to my application and in my web server (glassfish) I've got the connection to my database. But the issue I keep getting is once I hit login, it goes to my "ReadLogin.jsp" and doesnt move from there. the username and password are correct so I don't know the problem.

Code for my three pages is as follows

Login.jsp

    <%
      String error = request.getParameter("error");
      if (error == null || error == "null") {
          error = "";
      }
    %>
    <html>
    <head>
    <script>
        function trim(s) {
            return s.replace( /^\s*/, "" ).replace( /\s*$/, "" );
        }

        function validate() {
            if (trim(document.frmLogin.UserName.value) == "") {
              alert("Login empty");
              document.frmLogin.UserName.focus();
              return false;
            } else if(trim(document.frmLogin.Pwd.value)=="") {
              alert("password empty");
              document.frmLogin.Pwd.focus();
              return false;
            }
        }
    </script>
    </head>

    <body>
    <div><%=error%></div>
    <form name="frmLogin" onSubmit="return validate();" action="ReadLogin.jsp" method="post"> <%--return validate prompts script above to check if any text boxes are left empty--%>
    User Name <input type="text" name="UserName" /><br />
    Password <input type="password" name="Pwd" /><br />
    <input type="submit" name="Submit" value="Submit" />
    </form>
    </body>
    </html>

Next page is "ReadLogin.jsp"

<%
    Connection conn = null;
    Class.forName("com.mysql.jdbc.Driver");
    conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/project","root", "nbuser");

    ResultSet rsdoLogin = null;
    PreparedStatement psReadLogin = null;

    String sUserID = request.getParameter("UserName");
    String sPassword = request.getParameter("Pwd");
    String message = "User login successfully ";

    try {
   String sqlOption="SELECT * FROM USERS where"
                +" user_id='"+sUserID+"' and password'"+sPassword+"'";

    psReadLogin = conn.prepareStatement(sqlOption);
    psReadLogin.setString(1, sUserID);
    psReadLogin.setString(2, sPassword);

    rsdoLogin=psReadLogin.executeQuery();

    if(rsdoLogin.next()) {
      response.sendRedirect("success.jsp?error="+message);
    } else {
      message="No user or password matched" ;
      response.sendRedirect("login.jsp?error="+message);
    }
    }
    catch(Exception e)
    {
        e.printStackTrace();
    }


    /// close object and connection
    try{
         if(psReadLogin!=null){
             psReadLogin.close();
         }
         if(rsdoLogin!=null){
             rsdoLogin.close();
         }

         if(conn!=null){
          conn.close();
         }
    }
    catch(Exception e)
    {
        e.printStackTrace();
    }

%>

then the output page should be just a simple "success.jsp"

<html>
    <body>
        <h1>Hello World!</h1>
    </body>
</html>

It's got to be something wrong with my readlogig file as I've played around with another version and I can put data into the database from a jsp form but I can't get it to do a login feature, which would be the main function to the little tool I'm trying to develop

For one thing, your SQL has an extra `'` at the end which may be giving you a SQL error. Please indent consistently :( Check your logs. — Dave Newton, Jan 09 '13 at 19:09
I fixed that line, but I dont process through to the pages I originally wanted to, it just gets stuck on the readlogin.jsp — Curious_Bop, Jan 09 '13 at 22:29
Check your logs, add some debug statements or debug from an IDE. — Dave Newton, Jan 09 '13 at 22:35

score 1 · Accepted Answer · edited May 23 '17 at 10:24

String sqlOption="SELECT * FROM USERS where"
            +" user_id='"+sUserID+"' and password'"+sPassword+"'";

psReadLogin = conn.prepareStatement(sqlOption);
psReadLogin.setString(1, sUserID);
psReadLogin.setString(2, sPassword);

Either you create your request with ugly strings concatenation, or with a PreparedStatement. But don't do both! Here is how it should look like:

String sqlOption="SELECT * FROM USERS where user_id = ? and password = ?";

psReadLogin = conn.prepareStatement(sqlOption);
psReadLogin.setString(1, sUserID);
psReadLogin.setString(2, sPassword);

Apart from that, since you seem to have created this from scratch, I strongly recommend you to stop using those scriptlets and start reading about beans, servlets, JSP and JSTL.

Issue with jsp login from Mysql database

1 Answers1