条件是否出现故障？ JSP脚本

Question

I am facing a problem that I have no clue what it going on with it.. I made a small scriptlet in JSP page to check a simple condition, if there is a session then it does something, if not it should just redirect the page. but what happens is something i can't really explain.. the if condition is doing something really strange!

here is a sample code:

<%
boolean err = false;
if(session.getAttribute("id") != null)
    {
        cus_id = session.getAttribute("id").toString();
        err=false;
    }else  err=true;

    out.println(err);
    if (err) out.println("<br>There is no session<br>");
    //if(!err)   ############ where it goes completely wrong.##############
    if(1==2)
    {
      statement = "SELECT * FROM flight WHERE fl_code = '"+fco+"'";
      flight   = getData(statement);

      statement = "SELECT * FROM tickets WHERE tik_cus_id ='"+cus_id+"' AND tik_fl_id ='"+flight[0][0]+"'";
      ticket = getData(statement);

      if(ticket.length == 0)
      {
        statement = "INSERT INTO tickets VALUES(null,'"+   session.getAttribute("id")+
                                            "','"+flight[0][0]+
                                            "','"+cls+"','"+seat+
                                            "','"+adul+"','"+chil+
                                            "','"+infa+"','"+pric+"','N')";
        lastId = insertData(statement);
      }
      if(ticket.length==4) //if error occurs
      {
        out.println("<br><br>"+ticket[0]+"<hr>");
        out.println(ticket[1]+"<br>");
        out.println(ticket[2]+"<br>");
        out.println(ticket[3]+"<br>");
      }
      response.sendRedirect("../../confirm.jsp?fco="+flight[0][0]);
    }   else out.println("no session");//else response.sendRedirect("../../login.jsp");
%>

When the condition near where i pointed is if(!err) i get this error

`rg.apache.jasper.JasperException: Unable to compile class for JSP: 

An error occurred at line: 50 in the jsp file: /scripts/jsp/confirm.jsp
The local variable cus_id may not have been initialized
47:     statement = "SELECT * FROM flight WHERE fl_code = '"+fco+"'";
48:     flight   = getData(statement);
49:     
50:     statement = "SELECT * FROM tickets WHERE tik_cus_id ='"+cus_id+"' AND tik_fl_id ='"+flight[0][0]+"'";
51:     ticket = getData(statement);
52:     
53:     if(ticket.length == 0)`

which is obvious since there is no session, and cus_id comes from the session. but when I make the condition if(1==2) this is the output: true There is no session no session

As you can see there is not session.. I am 100% sure i have no session, yet when the condition is if(!err) (so when err is false, error is triggered when there is no session) it will get inside, however it clearly outputs that there is an error yet it goes inside the condition to try to execute the code.. but when I put the if(1==2) condition which is clearly false it does not.. I tried using integer, string, char and even double and float but whenever a variable gets into the condition it just passes it as true when it is not.. but it recognizes the if(1==2) or other similar conditions as false.

what is going on here? it is making absolutely no sense I am using Tomcat7 server, i played around with the code for hours now and it just doesn't make sense from any way I think about it.. all my tries were futile

Please help

Answer 1

If I understand correctly you're not running into anything your if condition actually does. Instead you're running into static code analysis that the compiler does: It determines that there is a condition under which your local variable might not be initialized and flags that.

When you deactivate a large block with if(1==2) the compiler is smart enough to determine that this block will never be executed and probably never generates any code for it (and ignores any flags inside it).

There are several ways to improve your code (incomplete, but a starting point):

• Omit memorizing err and just implement all the code within the original if condition
• Stop writing Java scriptlets in JSPs and use proper MVC - then you'd determine that you don't have a session before delegating to the JSP (and delegate to a different page, from the controller) and the page could just assume that there's always a session available

Answering your comment's question about what "omit memorizing err" means: Just don't have that variable. Pseudocode:

if(session.getAttribute("id") != null) {
    String cus_id = session.getAttribute("id").toString();
    // now cus_id is initialized, and local to this block 
    // (it's not used elsewhere anyway)

    // add your database code here
} else {
    // add your error handling code here
}

And not to forget: The way you're constructing your SQL instructions is prone to be attacked. Please read about prepared statements (eg parameterized queries) and about Little Bobby Tables .