Question

I finally got the password, the queries, the button and the connection, but how come it Seems I can’t seem to log in? what’s wrong with my Action Handler? please check my code

import java.awt.BorderLayout;
import java.awt.GridLayout;
import java.awt.event.ActionListener;
import java.awt.event.ActionEvent;
import javax.swing.JFrame;
import javax.swing.JOptionPane;
import javax.swing.JLabel;
import javax.swing.JTextField;
import javax.swing.JPasswordField;
import javax.swing.JButton;
import javax.swing.JPanel;
import java.sql.*;

public class Login extends JFrame {

    private JLabel label1, label2;
    private JButton submit;
    private JTextField textfield1;
    private JPasswordField passfield;
    private JPanel panel;

    public Login() {

        setSize(300, 100);
        setVisible(true);

        label1 = new JLabel("User ID:");
        textfield1 = new JTextField(15);
        label2 = new JLabel("Password:");
        passfield = new JPasswordField(15);
        submit = new JButton("Submit");
        panel = new JPanel(new GridLayout(3, 1));

        panel.add(label1);
        panel.add(textfield1);
        panel.add(label2);
        panel.add(passfield);
        panel.add(submit);
        add(panel, BorderLayout.CENTER);

        ButtonHandler handler = new ButtonHandler();
        submit.addActionListener(handler);
    }// end login constructor

    private class ButtonHandler implements ActionListener {

        public void actionPerformed(ActionEvent arg0) {

            String user = textfield1.getText();
            char[] passChars = passfield.getPassword();
            Connection conn = Jdbc.dbConn();
            PreparedStatement ps = null;
            ResultSet rs = null;
            String pass = new String(passChars);

            if (passChars != null) {
                String sql = "SELECT employee_ID,employee_password FROM user where" +
                          "employee_ID='user' and employee_password=+'pass'";

                try {
                    ps = conn.prepareStatement(sql);
                    ps.setString(1, user);
                    ps.setString(2, pass);
                    rs = ps.executeQuery();
                    if (rs.next()) {
                        user = rs.getString("employee_id");
                        pass = rs.getString("employee_password");
                        JOptionPane.showMessageDialog(null,"Welcome "+user);
                    } else {
                        JOptionPane.showMessageDialog(null, "Wrong Input");
                    }
                } catch (Exception e) {

                } finally {
                    try {

                        rs.close();
                        ps.close();
                        conn.close();
                    } catch (Exception ee) {

                    }
                }

            }// end actionPerformed

        }// End ButtonHandler

    }// End of class
}

Answer 1

you have two choices for PreparedStatement, both are correct

1) change String sql = .... definition

String sql = "SELECT employee_ID, employee_password FROM 
    user WHERE employee_ID = ? AND employee_password = ?";

2) put variables to the SQL statement directly

String sql = "SELECT employee_ID, employee_password FROM user WHERE 
     employee_ID = '" + user + "' AND employee_password = '" + pass + "'";