Java-Mysql Getter / Setter

Question

I'm newbie in java, I use getter and setter, as the user authentic. - How to add a query in the getter and setter? - How to use ResultSet, Statement on getter and setter?

Excuse my English, is very lousy. Thanks for your reply

My Class Connection

    public class con {
    String driver = "com.mysql.jdbc.Driver";
    String url ="jdbc:mysql://localhost:3306/tienda";
    String user = "root";
    String pw = "";
    Connection conn = null;
public ResultSet iList(String iSql){
       try{
           Class.forName(driver).newInstance();
           Connection oCnn  = DriverManager.getConnection(url,user,pw);
           PreparedStatement oPst = oCnn.prepareStatement(iSql);
           ResultSet oRst = oPst.executeQuery();
           return oRst;
       }catch(Exception e){
           return null;
       }
   }
   public String Exen(String iSql){
       try{
           Class.forName(driver).newInstance();
           Connection oCnn = DriverManager.getConnection(url, user, pw);
           PreparedStatement oPst = oCnn.prepareStatement(iSql);
           int i= oPst.executeUpdate();
           return null;
       }catch(Exception e){
           return "error "+e.getMessage();
       }
   }
}

My User Getter and setter

public class usuario {
   conexion cn = new con();
    private String id;
    private String name;
    private String lastn;
    private String dir;
    private String iPass;

    public String Eliminau(){
        String cad ="delete from tblusuario where idusuario='" + this.getId() + "'";
        return cn.Ejecutar(cad);
    }
    public String Login(){
        String cad = "SELECT * FROM tblusuario WHERE name  '" + this.getname() + "' AND pass = '"+
                this.getiPass() + "'";
        return cn.Ejecutar(cad);
    }

    public String agregar(){
        String cad = "INSERT INTO tblusuario VALUES('" + 
                this.getId() + "','" + this.getiPass() + "','" + this.getname() + "','" +
                this.getlastn() + "','" + this.getDir() +"')";
        return cn.Ejecutar(cad);
    }

    public String getId() { return id;}

    public void setId(String id) {this.id = id;}

    public String getname() { return name;}

    public void setname(String name) {this.name = name;}

    public String getlastn() {return lastn;}

    public void setlastn(String lastn) {this.lastn = lastn;}

    public String getDir() {return dir;}

    public void setDir(String dir) {this.dir = dir; }

    public String getiPass() { return iPass;}

    public void setiPass(String iPass) {
        String cript;
        cript = DigestUtils.md5Hex(iPass);
        this.iPass = cript;
    }    
}

Answer 1

First, your whole code is kinda badly composed. Don't return ResultSet or Statement at all. Best idea is to use DAO design pattern which will ensure clean code at least.

Also, in that example, it's shown how to use PreparedStatement to prevent SQL injection vulnerability. And your code is quite vulnerable. Here is mkyongs tutorial about JDBC too.

Here is my GitHub project about JDBC too. Made just for cases like yours. Download it and test it.