验证电子邮件地址和密码

Question

How do I validate a certain email and password while an user logs in?

protected void doPost(HttpServletRequest request, HttpServletResponse res) throws IOException, ServletException {

    String email=request.getParameter("email");
    String pass=request.getParameter("pass");

    OutputStream out = res.getOutputStream();

    try{
           Class.forName("com.mysql.jdbc.Driver");
           Connection con = DriverManager.getConnection("jdbc:mysql://localhost:8080/college", "root", "root");
           Statement st=con.createStatement();
           String strSQL = "SELECT email,password FROM student";

How do I continue after the SELECT statement? I would prefer using the if...else statement to do the validation.

Answer 1

First close all connection resources properly - use a Java 7 try-with-resources.

Here is an simple example:

final String email = request.getParameter("email");
final String pass = request.getParameter("pass");
try (final Connection con = DriverManager.getConnection("jdbc:mysql://localhost:8080/student", "root", "root");
        final PreparedStatement statement = con.prepareStatement("SELECT COUNT(*) AS count FROM student WHERE email=? AND password=?");) {
    statement.setString(1, email);
    statement.setString(2, pass);
    try (final ResultSet resultSet = statement.executeQuery()) {
        if (resultSet.next()) {
            final int rows = resultSet.getInt("count");
            if (rows > 1) {
                throw new IllegalStateException("More than one row returned!");
            }
            boolean validUser = rows == 1;
        }
    }
}

But really you should hash passwords in the database . Use something like jBcrypt . Your code would then look like:

final String email = request.getParameter("email");
final String pass = request.getParameter("pass");
try (final Connection con = DriverManager.getConnection("jdbc:mysql://localhost:8080/student", "root", "root");
        final PreparedStatement statement = con.prepareStatement("SELECT pass FROM student WHERE email=?");) {
    statement.setString(1, email);
    statement.setString(2, pass);
    try (final ResultSet resultSet = statement.executeQuery()) {
        if (resultSet.next()) {
            final String hash = resultSet.getString("pass");
            final boolean valid = BCrypt.checkpw(pass, hash);
        }
    }
}

Obviously you need to add error checking if there are no rows returned from the query. You also need to check that only one row is returned. But I leave that as an exercise.

Answer 2

you can use if, if you like. Use the input as your where statement and then check to see if there is a match, error or null, then execute whatever you want it to do.

Answer 3

You can use email and password in the SQL statement itself. like:

SELECT email, password from student where email = ? and password = ?

prepare above statement and bind the parameters.

This way validation will be done on the DB and you just need to check the result count (which has to be 1). You should have index on email column to have better SQL performance.

Answer 4

Do you relay need to fetch all students ?

    PreparedStatement st = con.prepareStatement("SELECT count(*) FROM student WHERE email=? AND password=?");
    st.setString(1, email);
    st.setString(2, pass);
    ResultSet rs = st.executeQuery();
    rs.next();
    int count = rs.getInt(1);
    if (count == 1) {
        // password and email are correct
    }

Answer 5

For this answer, I'll assume that by "validate email and password", what you mean is you want to authenticate the user based on their email address and a password. And not that you want to check whether the email address is a real email address.

So, the first thing you need to do is encrypt the passwords in your database , using a hash algorithm and a random salt. You record the salt alongside the hashed password.

Next thing is, when the user logs in, you look up the salt for that user, and you perform the same hash with the salt. Then you compare the result of that with the previously saved password hash, and if they're the same, then the passwords were the same.

It's important that the salt be random and different for every user.

Plenty of reading to be found on the above terms on the Internets.

Once you've done that, you should also apply the very sensible suggestions in other answers to only select the user you want, and handle your resources correctly.

WARNING I am not an expert on security, and neither are you. If you're implementing a log-in system for an exercise, fine. If it's for the real world, use something that's been written by someone who knows what they're doing.