即使数据库中的表为空，执行的SQL查询和结果集仍会返回记录？

Question

I've created a spring security UserService that checks if the user logged in(from a login page) exists in the database (jdbc) .

If the record exists then redirection to the home page ,else redirection to the access denied page.

I've tested it , it works well , But when I deleted the records from the database and tried to check , i've noticed that it still working like the records still exist in the database : authenticating with deleted username and password works !

Could someone tell me why ?

This is my code :

@Component(value = "userService")
public class UserService implements AuthenticationProvider {
@Inject
@Named(value = "dataSource")
private DataSource dataSource1;
String name;
String password;
int countRow=0;
public Authentication authenticate(Authentication auth) throws AuthenticationException {
    ResultSet resultSet = null;
    PreparedStatement preparedStatement = null;
    Connection connection = null;
    name= auth.getName();
    password=auth.getCredentials().toString();
    final String select= "select username,password from users where username='"+name+"'and password='"+password+"'";

    try {
        connection = dataSource1.getConnection();
        preparedStatement = connection.prepareStatement(select);
        resultSet = preparedStatement.executeQuery();
        if(resultSet.next()){
            countRow++;
            if(countRow!=0){

           return new UsernamePasswordAuthenticationToken(name, null);}
        }
        return null;
        }



    return new UsernamePasswordAuthenticationToken("", "");
}

Answer 1

Instead of this code

   if(resultSet.next()){
      countRow++;
        if(countRow!=0){

       return new UsernamePasswordAuthenticationToken(name, null);}
    }
    return null;

use

String select= "select username,password from users where username=? and password=?";//to avoid sql injection
preparedStatement = connection.prepareStatement(select);
preparedStatement.setString(1,name);
preparedStatement.setString(2,password);
............

if(resultSet.next())//condition is true, means record exists in database
{
//stuff to redirection to success
}
else
{
//stuff to access denied
}

But I didn't know that springs . Just check this