CODEWITHSUNDEEP
javamysqljdbcauthorization
user5410834
user5410834

Reputation:

JDBC - authorization users via database

I've made a program which is getting data from database and then authorizing, but the problem is only the last record is correct - logging in is succesful.

public class Test {
   static final String JDBC_DRIVER = "com.mysql.jdbc.Driver";  
   static final String DB_URL = "jdbc:mysql://localhost:3306/uzytkownicy";
   static final String USER = "root";
   static final String PASS = "";


public static void main(String[] args) throws SQLException, ClassNotFoundException {
    System.out.print("login: ");
    Scanner zm1= new Scanner(System.in); 
    String name = zm1.next();
    System.out.print("pass: ");
    Scanner zm2 = new Scanner(System.in);
    String password = zm2.next();
    try{
        Class.forName("com.mysql.jdbc.Driver");
        System.out.println("Connecting...");
        Connection conn = DriverManager.getConnection(DB_URL,USER,PASS);
        Statement stmt = conn.createStatement();
        String sql = "SELECT logins, passwords FROM users";
        ResultSet rs = stmt.executeQuery(sql);
        String databasePassword = null;
        String databaseUsername = null;

        while (rs.next()) {
            databaseUsername = rs.getString("logins");
            databasePassword = rs.getString("passwords");

        }
        if (name.equals(databaseUsername) && password.equals(databasePassword)) {
            System.out.println("Logged in!");
        } 
        else {
            System.out.println("Bad Pass/Login");
        }
        rs.close();
        stmt.close();
        conn.close();
        }
    catch(SQLException se){
         se.printStackTrace();

    }

} }

Upvotes: 0

Views: 97

Answers (1)

blm
blm

Reputation: 2446

If I'm understanding what you're trying to do (which I may not be), your problem is that the comparison of username and password is outside the while loop, so your:

while (rs.next())

just loops through the entire result set, so when the while loop ends, databaseUsername and databasePassword will be set to the values from the last row read.

Instead, move the comparison inside the loop and set a flag (defaulting to false) and break out of the loop if the correct username and password is found, then use that flag to determine what to print.

Also, you might want to read up on parameterized queries. You can actually have the database do all the work for you by using a PreparedStatement and making your query:

SELECT 1 from users where logins = ? and passwords = ?;

If the result set contains anything, then the user entered a valid username and password, otherwise they didn't. The question marks in the query would be set to name and password using the set* methods of PreparedStatement.

Another note--storing plaintext passwords is a horrible idea. If the table storing the passwords is exposed (through various attacks or just a disgruntled employee stealing it), then everyone has all your users' passwords. Eek! You might argue that you'll take steps to prevent that, but from a security perspective, it's best to assume someday the table will be compromised, and do everything you can to ensure that it's not too harmful.

Upvotes: 1

Related Questions