Member Avatar for mahaboob Basha

hi

can any one help me in this.. i have a html/jsp form in that i have a field .. enter password... first time password will be stored in the databse... from second time when user enters passowrd wrongly for 3 times then it has to dispay some msg contact ur administrator. can any one send me this code? plzzzzzzzzzzzzzzzz send it ASAp


Thanks&Regards
Mahaboob Basha

  • 4 Contributors
  • 6 Replies
  • 2K Views
  • 5 Years Discussion Span
  • Latest Post Latest Post by rexraja

Dani AI

Generated

Good direction from on counting attempts, but do not keep the counter in a hidden field; users can tamper with it. Track failures on the server (session + database), return a generic error either way, and lock the account for a short time after N failures to slow brute force. Also, never store plain passwords and avoid string‑built SQL. Use a password hash (bcrypt/Argon2) and parameterized queries. OWASP Password Storage and the Authentication Cheat Sheet cover both points.

Below is a minimal servlet workflow that fits your requirement without duplicating your code. It uses PreparedStatement and bcrypt (jBCrypt) for comparison:

// import org.mindrot.jbcrypt.BCrypt;

try (Connection conn = DriverManager.getConnection(url, dbUser, dbPass);
     PreparedStatement ps = conn.prepareStatement(
       "SELECT password_hash, failed_attempts, lock_until FROM users WHERE username = ?")) {
  ps.setString(1, user);
  try (ResultSet rs = ps.executeQuery()) {
    if (!rs.next()) { showGenericError(); return; }

    Timestamp lockUntil = rs.getTimestamp("lock_until");
    if (lockUntil != null && lockUntil.toInstant().isAfter(Instant.now())) {
      showGenericError(); return;
    }

    boolean ok = BCrypt.checkpw(pass, rs.getString("password_hash"));
    if (ok) {
      resetAttempts(conn, user); loginUser();
    } else {
      incrementAttemptsAndMaybeLock(conn, user, 3, Duration.ofMinutes(20));
      showGenericError();
    }
  }
}

Notes for this thread: @mahaboob Basha, avoid defining a method inside service() and stop concatenating user input into SQL; use PreparedStatement instead. It prevents injection and is the standard JDBC way to bind parameters. PreparedStatement JavaDoc. If you are on modern MySQL Connector/J, use the com.mysql.cj.jdbc.Driver class (or rely on auto‑registration) instead of the deprecated one. . For bcrypt in Java, jBCrypt is a small, battle‑tested library. jBCrypt.

Recommended Answers

All 6 Replies

Member Avatar for javaAddict

Have a variable that counts how many times the password has been entered.
When the password is wrong increase its value and put its value to a hidden field so to get it at request when the form is submitted again the next time.

Member Avatar for stephen84s

can any one send me this code? plzzzzzzzzzzzzzzzz send it ASAp

Yeah, sure the code is already available here

Member Avatar for mahaboob Basha

Have a variable that counts how many times the password has been entered.
When the password is wrong increase its value and put its value to a hidden field so to get it at request when the form is submitted again the next time.

Hi

Thanks for sending this i would feel happy if u send me the piece of java code as iam new to this java coding..

Member Avatar for javaAddict

If you have already a page that does the login and the inserts to the database,
then you are familiar with writing HTML, submiting forms, and getting the parameters from the request.

If you have written nothing and you expect to get the entire code, you won't. If you are new to java then this is not for you, because this isn't just basic java.

It will require something more than a few lines of java code for anyone to send. We will need to see your code and what you have written, in order to understand what kind of changes are required in YOUR code and where to put them

Member Avatar for mahaboob Basha 
import java.io.*;
import java.util.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;

 public class Validation extends HttpServlet
  {
  private ServletConfig config;
      public void init(ServletConfig config)throws ServletException
      {
       this.config=config;
      }

  public void service(HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException 
   {  
    String   userName   = request.getParameter("user"); 
    String   password   = request.getParameter("pass"); 
    PrintWriter out     =response.getWriter();
    HttpSession session = request.getSession();

    boolean login(String userName, String password) 
      {
      try {
      Class.forName("com.mysql.jdbc.Driver"); 
      Connection con =DriverManager.getConnection("jdbc:mysql://localhost/basha","root","3ptec"); 
      Statement s = con.createStatement(); 
      String sql = "SELECT user FROM user" + 
        " WHERE user='" + user + "'" + 
        " AND Password='" + password + "'"; 
      ResultSet rs = s.executeQuery(sql); 
      if (rs.next())
          {
        rs.close(); 
        s.close(); 
        con.close(); 
        return true; 
          } 
        rs.close(); 
        s.close(); 
        con.close(); 
          } 

       if(userName.equals(request.getParameter("user"))&& password.equals(request.getParameter("pass")))
        {
        out.println("<h1>User is Valid</h1>");
       }
        else
        {
       out.println("<h1>User is InValid</h1>");
        }

        if (!login(username, password) ) 
               {
		int count = Integer.parseInt( session.getAttribute("count") );
		if (count > 3) {
			response.sendRedirect("badbadUser.jsp");
		 }
		else {
			count++;
			session.setAttribute("count");
			response.sendRedirect("woopsWrongPasswordTryAgain.jsp");
		}

    catch (ClassNotFoundException e) 
     {
      System.out.println(e.toString()); 
    } 
    catch (SQLException e) {
      System.out.println(e.toString()); 
    } 
    catch (Exception e) {
      System.out.println(e.toString()); 
    } 
    return false; 
    }
}
  

    
    
}  	
}
Member Avatar for rexraja

create jsp login page and validate username and password database to check the username and password is wrong to display error message or correct the go to next page

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.