Member Avatar for kumar0559

how to connect a database from jsp to check username and password****

  • 3 Contributors
  • 2 Replies
  • 5K Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by jalpesh_007

Dani AI

Generated

Quick, secure approach: keep JDBC out of JSP. Post the login form to a servlet (or controller) that uses a pooled DataSource, parameterized SQL, and a strong password hash (bcrypt/Argon2). Never fetch all users or store plain-text passwords. Query exactly one row by username and verify the submitted password against the stored hash. Use HTTPS and return a generic error message to avoid user enumeration.

// LoginServlet#doPost
String u = request.getParameter("username");
String p = request.getParameter("password");

DataSource ds = (DataSource) new InitialContext().lookup("java:comp/env/jdbc/app");
try (Connection c = ds.getConnection();
     PreparedStatement ps = c.prepareStatement(
         "SELECT password_hash FROM users WHERE username = ? LIMIT 1")) {
  ps.setString(1, u);
  try (ResultSet rs = ps.executeQuery()) {
    boolean ok = false;
    if (rs.next()) {
      String stored = rs.getString(1);          // e.g., bcrypt hash
      ok = BCrypt.checkpw(p, stored);           // from jBCrypt or similar
    }
    if (ok) { request.getSession().setAttribute("user", u); response.sendRedirect("home.jsp"); }
    else    { request.setAttribute("error", "Invalid credentials."); request.getRequestDispatcher("/login.jsp").forward(request, response); }
  }
}

Notes:

  • Configure the JNDI DataSource in your container; no need to call Class.forName. If you must use DriverManager, use the modern driver com.mysql.cj.jdbc.Driver.
  • Ensure users.username is indexed and unique.
  • Use try-with-resources, do not log stack traces to the client, and throttle repeated failures.
  • See OWASP guidance: Password Storage Cheat Sheet.

Recommended Answers

All 2 Replies

Member Avatar for anand01

dear kumar0559,
show some of your code which you have tried, then you will get lot of reply

Member Avatar for jalpesh_007

you can do something using following code:

String connectionURL = "jdbc:mysql://192.168.10.59/messagepaging";
  Connection connection=null;
  ResultSet rs;
  String userName=new String("");
  String passwrd=new String("");
  response.setContentType("text/html");
  try {
 // Load the database driver
  Class.forName("com.mysql.jdbc.Driver");
  // Get a Connection to the database
  connection = DriverManager.getConnection(connectionURL, "root", "root"); 
  //Add the data into the database
  String sql = "select user,password from User";
  Statement s = connection.createStatement();
  s.executeQuery (sql);
  rs = s.getResultSet();
  while (rs.next ()){
  userName=rs.getString("user");
  passwrd=rs.getString("password");
  }
  rs.close ();
  s.close ();
  }catch(Exception e){
  System.out.println("Exception is ;"+e);
  }
  if(userName.equals(request.getParameter("user")) 
  && passwrd.equals(request.getParameter("pass"))){
  out.println("User is Valid");
  }
  else{
  out.println("You are not a Valid User");
  }
  }
}
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.