Question

Possible Duplicate:
Getting unexpected output in program

To be frank,this question may be silly to ask, but I’m a novice in Java.
This is my Table emp(name,id,address,date).

Now I’m going to match a certain employee’s corresponding password.

String sql = "select emp_id,password from regid";
ResultSet rs = st.executeQuery(sql);

while(rs.next()){
 // here will be iterate function using resultset,i guess
 // what should be the best logic to check the name and password...any inputs
 //in terms of code

if(if (employee.equals(rs.getString("emp_id")) && password.equals(rs.getString("password")))){
You are Mr. emp // in terms of code
}

else{
Who are You ?? //in terms of code
}
}

Any inputs will be highly appreciated.

Answer 1

Use a PreparedStatement to create your query. So your parameterized query for the PreparedStatement would be something like this:

SELECT * from regid WHERE emp_id = ? AND password = ?

Plug in the paremeter values and execute your statement. So it would be something like this:

PreparedStatement ps = null;
ResultSet rs = null;
boolean validUser = false;

try{
    ps = connection.prepareStatement("SELECT * from regid WHERE emp_id = ? AND password = ?");
    ps.setString(1, [user_id_input]);
    ps.setString(2, [user_pw_input]);
    rs = ps.executeQuery();

    validUser = rs.next();
}finally{
    //Release your resources
}

if(validUser){
    //user is validated
}

As a side note, I would also suggest to validate your user’s input before feeding it to your query.