Member Avatar for bhuvan83

hi all
i m making a project using jsp as my front end and mysql as my back end.
i had to change backend from oracle to mysql bcoz of clients request.
now there is 1 problem i m facing.
there a password change option.
person enters its old password and then new password twice n clicks on submit.
although the password gets changed but it shows the else part,that the password is not changed.
this was working fine with oracle but no with mysql.
what could b the problem

  • 3 Contributors
  • 3 Replies
  • 120 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by peter_budo

Dani AI

Generated

— the behaviour you describe after switching from Oracle to MySQL is commonly caused by differences in how JDBC drivers report update counts, not by the JSP logic itself. was right to ask about hashing (never assume plaintext), and is correct that database work belongs in servlets/DAOs, not inline JSP.

Quick diagnosis and checks:

  • Log the integer returned by executeUpdate(...) to see exactly what you get (0, 1, >1). That clarifies whether the driver reports 0 while the row was changed.
  • Run the same UPDATE from the MySQL client to observe server-side behavior.
  • Confirm you are not updating the row to the same value (old == new), and check for whitespace or case differences and the column collation.
  • Verify the WHERE clause actually matches the intended user (print the uname and parameters before the UPDATE).

A robust, immediate fix

  • Replace string-concatenated statements with a PreparedStatement and treat a positive update count as success (not strictly == 1). Example:
PreparedStatement ps = con.prepareStatement(
  "UPDATE userTab SET password = ? WHERE uname = ? AND password = ?");
ps.setString(1, newPassword);
ps.setString(2, userName);
ps.setString(3, oldPassword);
int rows = ps.executeUpdate();
if (rows > 0) {
  // success
} else {
  // no match / failure
}

Notes on driver behavior and security

  • MySQL Connector/J has configuration options that affect returned update counts; see the Connector/J configuration docs for details: .
  • Do not store plaintext passwords. Use a slow salted hash (bcrypt / PBKDF2 / Argon2). See OWASP for recommended password storage practices: OWASP Password Storage Cheat Sheet.

Moving DB logic into a servlet/DAO with connection pooling and prepared statements will make this easier to maintain and more secure.

Recommended Answers

All 3 Replies

Member Avatar for sn4rf3r

Oracle and mysql use two different password encryption algorithms.
Are you talking about the password to connect to the database, or a password for user authentication?
How did you store the password in the database? Plain text, MD5, homegrown hash?
Could you post the relevant code? not the whole file , just the call to teh databse (minus your user&oass for the DB)

Member Avatar for bhuvan83

hi bro.
thanks for ur reply.
i m asking for password for user authentication.
the code i m using is

<%@ page errorPage="changepassword_error.jsp" import="java.sql.*" %>
<html>
<head>
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>:: Intranet ::</title>
<link href="tools/style.css" rel="stylesheet" type="text/css" />
</head>
<body>
<%!
 Connection con;
 Statement st;
 ResultSet rs;
%>
<%
 if(session.getAttribute("theName")==null){
 response.sendRedirect("index_session.html");
}
 session.getAttribute("theName");
 String s2=request.getParameter("T2");
 String s3=request.getParameter("T3");
 try{
 //Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
 //con=DriverManager.getConnection("jdbc:odbc:index","scott","tiger");
 Class.forName("com.mysql.jdbc.Driver");
 String url ="jdbc:mysql://localhost:3306/Timesheet";
 con =DriverManager.getConnection(url,"root", "");
 st=con.createStatement();
 int p=st.executeUpdate("update userTab set password='"+s3+"' where uname='"+session.getAttribute("theName")+"' and password='"+s2+"'");
 if(p==1)
 {
 //  response.sendRedirect("index.html");
 //out.println("Password saved successfully!!!!!!!!!!!!!!");
%>
<script type="text/javascript">
 alert("You have changed your password successfully!")
 //window.history.load("mainscreen.jsp")
 window.location.assign("index.html")
</script>
<!--<table width="100%" border="0" cellpadding="0" cellspacing="0" class="base">
  <tr>
    <td><table width="100%" border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td width="150">
          <img src="images/logo.gif" alt="" /></td>
          <td class="top-bg">&nbsp;</td>
          <td width="196">
          <img src="images/top_right.gif" alt="" /></td>
        </tr>
      </table></td>
  </tr>
  <tr>
    <td height="22" class="top-menu"><table width="100%" border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td></td>
          <td></td>
        </tr>
      </table></td>
  </tr>
<table align="center"><tr><td><img src="images/trans.gif" alt="" width="20" height="10" ></td><td valign="bottom" height="30" ><font color="red"><b>Your password has changed successfully!</td></tr>
<tr height="30" align="center">
<td></td><td><a href="mainscreen.jsp">OK</a>
</td>
</tr></table>-->
<%
 }
 else{
 %>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="base">
  <tr>
    <td><table width="100%" border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td width="150">
          <img src="images/logo.gif" alt="" /></td>
          <td class="top-bg">&nbsp;</td>
          <td width="196">
          <img src="images/top_right.gif" alt="" /></td>
        </tr>
      </table></td>
  </tr>
  <tr>
    <td height="22" class="top-menu"><table width="100%" border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td><!--<span class="welcome">Welcome! Shalini</span> Today is 11th Jan--></td>
          <td align="right"><font color="white"><a href="mainscreen.jsp">Main menu</a> | <a href="changepassword.html">Change password</a> | <a href="logout.jsp">Logout</a></td>
        </tr>
      </table></td>
  </tr>
<table align="center"><tr><td><img src="images/trans.gif" alt="" width="20" height="10" ></td><td valign="bottom" height="30" ><font color="red"><b>Password mismatch! Please try again.</td></tr>
<tr height="30" align="center">
<td></td><td><a href="mainscreen.jsp">OK</a>
</td>
</tr></table>
<%
   //out.println("Please try again.....................");
     }
   }catch(Exception ee){out.println(ee);}
%>

</body>
</html>
Member Avatar for peter_budo

It is bad idea to setup conection to DB in JSP. It is all fashioned and left only for back compability from dark age of Java Web Development. You better of using servlets to handle connection and changes to DB

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.