a login form error + JDBC CONNECTIVITY(JAVA-MYSQL)

Question

I have a project with JDBC connectivity (JAVA-MYSQL) which has a login up form. But the coding doesn't work.(meaning it always shows "WRONG PASSWORD" though I'm sure its the right one).

Please find the error. (cause it shows none).

 private void jButton1ActionPerformed(java.awt.event.ActionEvent evt) { String S; String email = jTextField3.getText(); try { Class.forName("java.sql.Driver"); Connection con = DriverManager.getConnection("jdbc:Mysql://localhost/nami", "root", "123456"); Statement st = con.createStatement(); S = "SELECT password FROM signup WHERE email =" + "'" + email + "'" + ";"; st.executeQuery(S); String pass = new String(jPasswordField2.getPassword()); if (pass.equals("S")) { jOptionPane1.showMessageDialog(null, "YOU HAVE SUCCESSFULLY LOGGED IN"); MAINPAGE at = new MAINPAGE(); jDesktopPane1.add(at); at.show(); } else { jOptionPane1.showMessageDialog(null, "WRONG PASSWORD!!"); } } catch (Exception e) { jOptionPane2.showMessageDialog(null, "Error" + e.getMessage()); } } 

Answer 1

pass.equals("S") means that your password should always be S in order to log in success.

You need to query from the database and then compare it.

Result rs = st.executeQuery(S);
String queryPass = null;
if(rs.next()){
   queryPass = rs.getString("password");
}

if (pass.equals(queryPass)) {
  jOptionPane1.showMessageDialog(null, "YOU HAVE SUCCESSFULLY LOGGED IN");
  MAINPAGE at = new MAINPAGE();
  jDesktopPane1.add(at);
  at.show();

} else {
  jOptionPane1.showMessageDialog(null, "WRONG PASSWORD!!");
}

BTW,it's a bad idea to pass parameters directly into your sql,you need to use PreparedStatement instead of Statement to avoid SQL Injection

Answer 2

## Try This ##

 String email=request.getParameter("email");
   String pass=request.getParameter("pass");



                     Class.forName("com.mysql.jdbc.Driver");
                     Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/users_record","root","root");
                     Statement st1=con.createStatement();
                     ResultSet obj1=st1.executeQuery("select * from registration where email='" +email+ "'");

                     System.out.println(email);        
                     while(obj1.next())
                        {

                             String p2=obj1.getString(5);
                             if(p2.equals(pass))
                                 {

                                     response.sendRedirect("home1.jsp?msg=YOU HAVE SUCCESSFULLY LOGGED IN ");


                                 }
                             else
                                 {
                                       response.sendRedirect("login1.jsp?msg=Invalid password");
                                 }
                        }