Java 登录表单以某种方式跳过 if-else 语句

Question

I am trying to create a Login and Register form using Java and SQL Workbench. The Register form works properly as the Username and Password are added to the SQL Database. As for the Login form, everything looks fine. But, when it is executed, it skips the If Statement and goes straight to the Else Statement. The Username and Password are correct as I checked the SQL Database table. The output is a SqlSyntaxErrorException. Therefore, I think my syntax is wrong. Any help would be highly appreciated!

This is the code below:

if (e.getSource() == LOG_IN_BUTTON)
    {

        String userName = USER_NAME_TEXTFIELD.getText();
        String password = PASSWORD_TEXTFIELD.getText();

        try {
            connection = DriverManager.getConnection("jdbc:mysql://localhost:3306/airline_connect",
                    "root", "Yasser1595");

            String sql = "Select user_name, password from account where user_name=? and password=?";

            st = connection.prepareStatement(sql);

            st.setString(1, userName);
            st.setString(2, password);
            ResultSet rs = st.executeQuery(sql);
            if (rs.next()) {
                frame.dispose();
                new MainGame();
                JOptionPane.showMessageDialog(LOG_IN_BUTTON, "You have successfully logged in");
            } else {
                JOptionPane.showMessageDialog(LOG_IN_BUTTON, "Wrong Username & Password");
            }
        } catch (Exception exc) {
            exc.printStackTrace();
        }

    }

Answer 1

Try the following,

ResultSet rs = st.executeQuery();

Don't pass the sql string to executeQuery . When you pass the sql string to executeQuery it considers it as plain text instead of prepared statement

Answer 2

You did not use PreparedStatement.executeQuery() but the parent's Statement.executeQuery(sql) which is a known pitfall. Also it is worth using try-with-resources with local variables. Not closing things can cause resource leaks.

   String sql = "select user_name, password from account where user_name=? and password=?";
   try (Connection connection = DriverManager.getConnection("jdbc:mysql://localhost:3306/airline_connect",
                "root", "Yasser1595");
            PreparedStatement st = connection.prepareStatement(sql)) {

        st.setString(1, userName);
        st.setString(2, password);
        try (ResultSet rs = st.executeQuery()) { // No sql parameter.
            if (rs.next()) {
                frame.dispose();
                new MainGame();
                JOptionPane.showMessageDialog(LOG_IN_BUTTON, "You have successfully logged in");
                return;
            }
            JOptionPane.showMessageDialog(LOG_IN_BUTTON, "Wrong Username & Password");
        }
    } catch (SQLException exc) {
        exc.printStackTrace();
    }

---

It still did not work

• PASSWORD also is a function, but as no syntax errors happend, that probably is no problem. You might try "password" (= column name).
• The column might store not the password - which is a security risk, should the database be stolen in the future. It might store some hash of the password.

So:

String sql = "SELECT user_name, \"password\" "
    + "FROM account "
    + "WHERE user_name=? AND \"password\"=PASSWORD(?)";

First check how passwords (or their hashes) are stored.

It might also be the case that the password handling is done at the java side, for instance by taking the MD5 of the password and storing that.

Should all work, consider an other securite measure: if the password field is a JPasswordField one should ideally not work with a String , but a char[] that can be wiped out after usage ( Arrays.setAll(pwdArray, ' '); ). A String could reside long in memory, which might be a security risk.