Java仪表板登录错误

Question

I have been doing the java project. I am faced with the trouble in dashboard login code. I have the login code as belows.

String fieldtxtname=txtusername.getText();
String fieldtxtpw=txtpassword.getText();
String fieldtxtutype=txttypeof.getText();
try{

    Connection cnn=DriverManager.getConnection("jdbc:mysql://localhost/student","root","");
    Statement stm=cnn.createStatement();

    String sqlQuery="select username,password,typeof from tbl_user";

    ResultSet rs=stm.executeQuery(sqlQuery);

      while(rs.next()){
        String unamedb=rs.getString("username");
        String pworddb=rs.getString("password");
        String tofdb=rs.getString("typeof");
         if(fieldtxtname.equals ("")||fieldtxtpw.equals ("")||fieldtxtutype.equals ("")){
            System.out.println("The fields arenot filled properly");
            }
          else if(fieldtxtname.equals(unamedb)&&fieldtxtpw.equals(pworddb)&&fieldtxtutype.equals(tofdb)){
            System.out.println("Access granted");
            }
         else
            {
            System.out.println("Unknown username"); 
            }


      } 

}
catch(SQLException ex){
    System.out.println(ex);
} 

The code works fine except that when the access in granted,it prints as

 Access granted
    Unknown username
    Unknown username
    Unknown username
    Unknown username

Similar is the case when the fields are empty ie they print five timesvlike belows.

The fields arenot filled properly
The fields arenot filled properly
The fields arenot filled properly
The fields arenot filled properly
The fields arenot filled properly

.I am not figuring out the cause of the problem.Please help and I would like to thank a lot in advance.

Answer 1

Why you don't add your three parameter (fieldtxtname,fieldtxtpw,fieldtxtutype) to your query in where clause as bind variables!

 String fieldtxtname=txtusername.getText();
    String fieldtxtpw=txtpassword.getText();
    String fieldtxtutype=txttypeof.getText();
    if(fieldtxtname.equals ("")||fieldtxtpw.equals ("")||fieldtxtutype.equals ("")){
        System.out.println("The fields arenot filled properly");
        return;
    }

    try{

        Connection cnn= DriverManager.getConnection("jdbc:mysql://localhost/student","root","");

        PreparedStatement pstm = cnn.prepareStatement("select username,password,typeof from tbl_user where username= ? and password= ? and typeof  = ?");
        pstm.setString(1, fieldtxtname);
        pstm.setString(2, fieldtxtpw);
        pstm.setString(3, fieldtxtutype);

        ResultSet rs=pstm.executeQuery();

        while(rs.next()){
            System.out.println("Access granted");
            return;
        }

        System.out.println("Access not granted");

    }
    catch(SQLException ex){
        System.out.println(ex);
    } 

Answer 2

Adding comments to the current code implementation that you've posted and how you can overcome printing multiple times on the output.

ResultSet rs=stm.executeQuery(sqlQuery); // this is returning 5 elements

while(rs.next()) {
    String unamedb=rs.getString("username");
    String pworddb=rs.getString("password");
    String tofdb=rs.getString("typeof");
    if(fieldtxtname.equals ("")||fieldtxtpw.equals ("")||fieldtxtutype.equals ("")){
        System.out.println("The fields are not filled properly.");
        break;
// you might want to break the loop if the fields are empty in db
    } else if(fieldtxtname.equals(unamedb)&&fieldtxtpw.equals(pworddb)&&fieldtxtutype.equals(tofdb)) {
        System.out.println("Access granted");
        break;
// you might want to break the loop once the username, passwrod is found for access to be granted
    } else {
        System.out.println("Unknown username"); // just to display information
    }
} 

PS - Ideally for a unique combination of username and password I would expect it to return just 1 element.

Edit - For using PreparedStatement to solve the above without using the loop, do look at the answer from @Arvind

Answer 3

You must perform validation before authentication , ie before you connect to db check if all mandatory fields are filled by user.

String fieldtxtname=txtusername.getText();
String fieldtxtpw=txtpassword.getText();
String fieldtxtutype=txttypeof.getText();
//validation
if(fieldtxtname.isEmpty()||fieldtxtpw.isEmpty()||fieldtxtutype.isEmpty()){
  System.err.println("All fields are mandatory !");
}else{
  //authentication
  try{
    Connection cnn=DriverManager.getConnection("jdbc:mysql://localhost/student","root","");

    //just get one row based user input, why to get same column values, when user is gonna give same input?
    String sqlQuery="select 1 from tbl_user where username=? and password=? and typeof=?";

    // Prefer `PreparedStatement` over `Statement`, when you have runtime values for sql queries, this for avoiding SQL injection
    PreparedStatement ps = cnn.prepareStatement(sqlQuery);
    ps.setString(1,fieldtxtname);
    ps.setString(2,fieldtxtpw);
    ps.setString(3,fieldtxtutype);
    ResultSet rs=ps.executeQuery();

    if(rs.next()){//no need of loop
        System.out.println("Access Granted ...");
    }else{
        System.err.println("Access Denied !");
    }

    rs.close();
    ps.close();
    cnn.close();
  }catch(SQLException e){
    e.printStackTrace(System.err);
  }
}

Answer 4

You need to use where condition in your query. It will help you to execute your query fast compared to your's, ie without where condition.

String fieldtxtname=txtusername.getText();
String fieldtxtpw=txtpassword.getText();
String fieldtxtutype=txttypeof.getText();
    if(fieldtxtname.equals ("")||fieldtxtpw.equals ("")||fieldtxtutype.equals ("")){
        System.out.println("The fields are not filled properly");
    }else{
    try{
        Connection cnn=DriverManager.getConnection("jdbc:mysql://localhost/student","root","");
        Statement stm=cnn.createStatement();
        String sqlQuery="select username,password,typeof from tbl_user where username="+fieldtxtname+",password="+fieldtxtpw+",typeof="+fieldtxtutype;
        ResultSet rs=stm.executeQuery(sqlQuery);
        boolean flag=true;
        while(rs.next()){
            flag=false;
            System.out.println("Access granted");
        } 
        if(flag){
            System.out.println("Unknown username"); 
        }
    }
    catch(SQLException ex){
        System.out.println(ex);
    }
}