检查记录是否存在的最佳方法

Question

what is the best way to check if the user is exist

i have wrote this code

try{
PreparedStatment mPre=conn.preparedStatement(INSERT INTO TABLE VALUES(?,?);
}catch(Exception e)
{
if(e.getMessage().contains("Dublicated"))
{
throw new Exception("user is exist");
}
}finally {
mPre.close();
conn.close();

}

my friends told me that this is stupid query and i should do like this

Statement stm = con.createStatement();
ResultSet rs = stm.executeQuery("SELECT COUNT(*) AS total FROM .......");
int cnt = rs.getInt("total");

Answer 1

Your friend is right. You can check if row exists by query:

SELECT EXISTS(SELECT 1 FROM *table* WHERE *something*)

Answer 2

When you are trying to verify if the given username and password exists in your user table, you should use PreparedStatment because it will help you in protecting your application from SQL injection.

But

Inserting a new user to the database is not the right way to do user validation.

You can do something like this example:

 String selectSQL = "SELECT * FROM USER_TABLE WHERE USER_ID = ? AND PASSWORD = ?";
 PreparedStatement preparedStatement = dbConnection.prepareStatement(selectSQL);
 preparedStatement.setInt(1, 1001);
 preparedStatement.setString(2, "1234");
 ResultSet rs = preparedStatement.executeQuery(selectSQL );
 while (rs.next()) {
     //You will need user information to render dashborad of your web application
     String userid = rs.getString("USER_ID");
     String username = rs.getString("USERNAME");    
 }

Complete code refrence: http://www.mkyong.com/jdbc/jdbc-preparestatement-example-select-list-of-the-records/

Answer 3

As long as you are trying to insert a row that breaks the unique primary key constraint of database tables AND the exception thrown has a stack trace that contains the word "duplicated" then your code should work fine.
But in the unlikely event that the stack trace changes and does NOT contain that word, your code won't work anymore.
It's more likely that you are trying to insert a row with a unique primary key value but an existing username, which won't give you the error that you hope for. That's the reason why it would be smarter/safer to retrieve results for that username and count how many results there are.