How do I perform a simple email/password verification in JSP using a SQL database?

Question

I have the code that successfully establishes a connection to a mySQL database.

    String email, password; //assume these are already loaded with user-entered data.

    try {
        Class.forName("com.mysql.jdbc.Driver");
    } catch (ClassNotFoundException e) {
        return false;
    }

    Connection conn = null;

    try {
        conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/main", "root", "password123");
    } catch (SQLException e) {
        return false;
    }

    //perform my database actions here///////////////

    ///////////////////////////////////////////////////

    try {
        conn.close();
    } catch (SQLException e) {
        return false;
    }

I have a couple of strings in the scope of the code above that already have the email and password entered by a user on a login page. I need to look through the database for a matching email address and then verify that the password matches what the user entered in the form.

My table has 3 columns: id, email, and password.

I have pushed two rows into the table using the sql workbench

1 | email@gmail.com | password1

2 | email2@gmail.com | password2

I'm assuming in pure SQL I have to do something like

SELECT * FROM users WHERE email LIKE 'email@gmail.com' AND password LIKE 'password1';

But I'm not quite sure how to actually send these SQL commands to the database and receive info back using JSP. Also, I'm not entirely sure my SQL logic is the ideal way to verify a password. My thinking with the SQL command above was that if the database finds any row that meets the conditions, then the email/password combination are verified. Not sure if this is a great way to do it though. I'm not looking for the most secure and complicated way, I'm just looking for the simplest way that makes sense at the moment. Every tutorial I find seems to do it differently and I'm a bit confused.

Answer 1

Here's an example you can use from something I've worked on (I'm assuming that the connection "conn" is obvious):

    PreparedStatement st = null;
    ResultSet rec = null;

    SprayJobItem item = null;

    try {

        st = conn.prepareStatement("select * from sprayjob where headerref=? and jobname=?");
        st.setString(1, request.getParameter("joblistref"));
        st.setString(2, request.getParameter("jobname"));

        rec = st.executeQuery();
        if (rec.next()) {
            item = new SprayJobItem(rec);
        }

    } catch (SQLException ex) {
        // handle any errors
        ReportError.errorReport("SQLException: " + ex.getMessage());
        ReportError.errorReport("SQLState: " + ex.getSQLState());
        ReportError.errorReport("VendorError: " + ex.getErrorCode());

    } catch (Exception ex) {
        ReportError.errorReport("Error: " + ex.getMessage());
    } finally {
        // Always make sure result sets and statements are closed,
        if (ps != null) {
        try {
            ps.close();
        } catch (SQLException e) {
            ;
        }
        ps = null;
    }
    if (rs != null) {
        try {
            rs.close();
        } catch (SQLException e) {
            ;
        }
        rs = null;
    }
    }

In your case instead of item = new SprayJobItem(rec); you would have code that notes that the user is valid as the record has been found.