0

This query is not executed and the code going to catch block. ISSUE in Query May be in whileloop....

try {

    getConnection();

    String user = text.getText().trim();
    String pass = password.getText().trim();

    String query = "Select name,password from pharmacy.login where name = '" + user + "' and  password = '" + pass + "'";

    result = statement.executeQuery(query);

    System.out.println("hii");
    int count = 0;

    while (result.next()) {
        count++;
    }
}
sanastasiadis
  • 1,182
  • 1
  • 15
  • 23
Ahsan Javaid
  • 1
  • 2
  • you have asked no question.what is your question?.please take time to format you code properly for readability seek. – suulisin May 04 '16 at 11:26
  • Look at [here](http://meta.stackexchange.com/questions/22186/how-do-i-format-my-code-blocks) for how to format code appropriately. – Aconcagua May 04 '16 at 11:28

1 Answers1

1

Your code is prone to SQL-injection, but given the situation please read-on.

In order to find the reason that the query is not executed, you should catch the exception and log it. It may provide useful information on how to solve your issue.

But if your target is just to count the records found, then you should change the query to:

select count(*) from pharmacy.login where name='...' and password='...'

However, your code is prone to SQL-injection.

Normally, you should use PreparedStatement with ? or an ORM framework to retrieve your user object, and the search criteria should be the username only.

select username, password from pharmacy.login where name = ?

The database contents in the Password field should be encrypted, and the input value of the password from the user should be encrypted also.

After retrieving the user object, you should compare the encrypted password field and the encrypted input password value.

sanastasiadis
  • 1,182
  • 1
  • 15
  • 23
  • I would prefer the following variant: `String pass = sha256(password.getText().trim());` (if using sha256 - left out the MessageDigest stuff, though), rest as you propose, but with `WHERE name = ? AND password= ?`. I tend to rename column to pw_hash or something alike... Still good answer, +1. – Aconcagua May 04 '16 at 15:09
  • If it helps: Calculating digests in Java, see [here](http://stackoverflow.com/questions/3103652/hash-string-via-sha-256-in-java). – Aconcagua May 04 '16 at 15:13