Check your login and password (Java Web, Servlets)

Question

I'm trying to verify that the user name and password entered in the JSP page with data from a database, all the parameters are coming, but even when matching data, the function returns false. What is my fault?

Here is my code:

public class LoginService {
    public boolean loginCheck(String username, String password){
        String query;
        String dbUsername, dbPassword;
        boolean login = false;

        try {
            Class.forName("com.mysql.jdbc.Driver").newInstance();
            Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/blog_u", "root", "root");
            Statement stmt = (Statement) con.createStatement();
            query = "SELECT username, password FROM user;";
            stmt.executeQuery(query);
            ResultSet rs = stmt.getResultSet();

            while(rs.next()){
                dbUsername = rs.getString("username");
                dbPassword = rs.getString("password");

                if(dbUsername == username && dbPassword == password){
                    System.out.println("OK");
                    login = true;
                }
                System.out.println(username + password + " " + dbUsername + dbPassword);
            }
        } catch (InstantiationException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (SQLException e) {
            e.printStackTrace();
        }
        return login;
    }
}

Passwords should never be stored in Strings. [They should be stored in a `char[]`](http://stackoverflow.com/questions/8881291/why-is-char-preferred-over-string-for-passwords). — syb0rg, Apr 28 '13 at 15:47
Or (in this case because you have plain text passwords) let the database compare them for you. Add a `where` clause with username and password in your SQL query and check that it returns something. If it does, the user details are correct. — Sotirios Delimanolis, Apr 28 '13 at 15:49
The actual problem is bigger than that. You're hauling the entire DB table into Java's memory and comparing every single row against the input. This is terribly inefficient. You're not understanding/utilizing the powers of the SQL language. You should write SQL queries in such way that it returns **exactly** the data you're looking for. Start learning how to use the `WHERE` clause. When used properly, the DB would then return 0 or 1 record. You can then just do `login = rs.next();`. Or don't you trust the DB in returning the desired data for the given `WHERE`? — BalusC, Apr 29 '13 at 03:51
I redid the test using WHERE, the code is smaller and easier now — stark, Apr 29 '13 at 09:06
As a side note: don't forget to close resources in the **finally** block. — informatik01, Apr 29 '13 at 20:34

score 3 · Accepted Answer · edited May 23 '17 at 12:32

3

if(dbUsername == username && dbPassword == password){

should change to

if(dbUsername.equals(username) && dbPassword.equals(password)){

Strings shouldn’t be compared using == in java. See How do I compare strings in Java?.

edited May 23 '17 at 12:32

Community

1
1

answered Apr 28 '13 at 15:42

Étienne Miret

6,448
5
24
36

Check your login and password (Java Web, Servlets)

1 Answers1