Display message on the page using jsp when button is submitted

Question

I am working on message page, I have fetched the different part of message from the database and show it in table now when the user clicks on check button it should show him the message in brief. How to implement this please explain in brief.

My coding attempt for this problem:

<form  action="Check Notification.jsp" method="post">   
    <table>
    <tr>
            <th>From</th>
        <th>Message</th>
        <th>Check</th>
            <th>Delete</th>
    </tr>
        <%
            Class.forName(driver).newInstance();
            con = DriverManager.getConnection(url + db, uname, password);
            Statement st = con.createStatement();
            String query = "Select * from push_mail WHERE rec_id='"+adm+"'";
            ResultSet rs=st.executeQuery(query);                  
        %>                     
        <%
            while(rs.next()){
        %>
                <tr>
                    <td><%=rs.getString("send_id")%></td>
                    <td style="display: none">
                        <input type="text" name="message" value='<%=rs.getString("m_id")%>' />
                    </td>
                    <td><%=rs.getString("m_sub")%><br/><%=rs.getString("date")%></td>
                    <td>
                        <input type="submit" name='check' value="Check" onclick="check()"/>
                    </td>
                    <td><img alt="Delete" src="images/Delete.jpg" width="30px" height="30px" /></td>

               </tr>
           <%
                }
           %>        
    </table>
</form> 
<p >
<%
    String msgid= request.getParameter("message");
    Class.forName(driver).newInstance();
    con = DriverManager.getConnection(url + db, uname, password);
    Statement st1 = con.createStatement();
    String msg = "Select * from push_mail WHERE m_id='"+msgid+"'";
    ResultSet rs1=st1.executeQuery(msg);                  
    while(rs.next()){
        String msgs=rs.getString("m_message");
        out.println(msgs);
    }
%>

</p>

Answer 1

1. Use Ajax (ie Javascript that sends a request to the server behind the scenes). JSP is a server-side technology and therefore cannot respond to client-side events and stay on the same page. It can only respond to form submissions, which means you change pages, unless the submission was sent via Ajax.

2. Don't do database access inside JSP (use servlets). One reason among many: you can easily expose your db password on error.

3. Don't stick user input directly into an SQL statement (they can do SQL injection that way).

4. Don't make JSP pages submit to themselves (submit to a servlet).