authentication page

[roy ramos]

Hi, can anyone help me with this code i'm new in programming, when i try this code it always prompt me "You are not an authentic person" but the user name and password that i use to login is correct, can somebody help to check where can i go wrong

here is the jsp file Authentication.jsp

<%@ page language="java" %>
Please enter your Name and Password here:
<br>
<br>
<form name="frm" action="/e-app/Authentication" method="Post" >
Name:   <input type="text" name="user" value=""/>
Password:<input type="password" name="pass" value=""/>
   <input type="submit" value="Check" />
</form>

here is the servlet Authentication.java

package pack;

import java.io.*;
import java.util.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;

public class Authentication extends HttpServlet{

  private ServletConfig config;
  
  public void init(ServletConfig config)
    throws ServletException{
     this.config=config;
     }
  public void doPost(HttpServletRequest request, HttpServletResponse response) 
              throws ServletException,IOException{
      
    PrintWriter out = response.getWriter();
    String connectionURL = "jdbc:jtds:sqlserver://server/database";
    Connection connection=null;
    ResultSet rs;
    String userName=new String("");
    String passwrd=new String("");
    response.setContentType("text/html");
    try {
       
      Class.forName("net.sourceforge.jtds.jdbc.Driver");
      
      connection = java.sql.DriverManager.getConnection(connectionURL, "sa", "tjqofl"); 
      
      String sql = "select USER_ID,PASSWORD from PASSWORD_MASTER";
      Statement s = connection.createStatement();
      s.executeQuery (sql);
      rs = s.getResultSet();
      while (rs.next ()){
        userName=rs.getString("USER_ID");
        passwrd=rs.getString("PASSWORD");
      }
      rs.close ();
      s.close ();
      }catch(Exception e){
      System.out.println("Exception is ;"+e);
      }
      if(userName.equals(request.getParameter("user")) && 
            passwrd.equals(request.getParameter("pass"))){
        out.println("User Authenticated");
      }
      else{
        out.println("You are not an authentic person");
      }
  }
}  

here is my web.xml

<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">

     <servlet>
        <servlet-name>login</servlet-name>
        <servlet-class>pack.Authentication</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>login</servlet-name>
        <url-pattern>/Authentication</url-pattern>
    </servlet-mapping>
	

</web-app>

need help really really need help

[Andrew Monkhouse]

2 suggestions:

Ask a question. I do not know if you are having a problem with your JSP, your servlet, or your web.xml file. Or whether your problem is unrelated to any of these - perhaps it is a JDBC issue, or an SQL issue. You have not said what exactly you would like help with

UseCodeTags (click the link to find out more). Please click the button to go back and edit your post and add the code tags.

[Aditya Keyal]

1) For starters log the values of password and username that you have retrieved from the database. They are an obvious mismatch from the input values thats why you are not being authenticated.

2) You are retrieving all the rows from your database table. Which means that even if your password and username is correct but there are more than one sets of correct username's and passwords your program has a high chance of not working.
So retrieve a row using the specific username in the WHERE clause. It will help.

3) Also preferred is that you should log the values you have retrieved from the request scope by first reading them into a string variable.

[roy ramos]

Sir Aditya,

I only have 1 entry on my testing database

[Deepak Bala]

What is the user name and password you get from the request ? Log it

What is the user name and password you get from the database ? Log it

Compare both. Of course you will have to remove the logs after you are done

[Aditya Keyal]

Also can you check the server logs. I have a feeling your database call might be failing but is getting caught in the catch-block and absorbed. Check your server logs first to confirm if you have any errors.

[Andrew Monkhouse]

First some general comments:

You are not using the ServletConfig in the code you presented - while not causing a problem, it is generally considered a good thing to only have the minimum code needed to solve your problem (or to demonstrate your problem).

The code:

		String userName = new String("");
		String passwrd = new String("");

is creating a new String object on a static String object. So at the end of running those lines of code, you will have 3 instances of the "" string - not very efficient. For your purposes, you could get away with

		String userName = "";
		String passwrd = "";

You are potentially leaking connections to your database since you are not closing the Connection you have created. In addition, if there is any exception in any part of your code you will potentially also leak the ResultSet and the Statement. You should change the logic to use a try...catch...finally block. For example:

		Connection connection = null;
		ResultSet rs = null;
		Statement s = null;
		try {
			connection = java.sql.DriverManager.getConnection(connectionURL,
					"sa", "tjqofl");
			s = connection.createStatement();
			rs = s.getResultSet();
			// etc
		} catch (Exception e) {
			e.printStackTrace();
		} finally {
			closeDatabase(connection, rs, s);
		}
		// ...
	}

	private void closeDatabase(Connection connection, ResultSet rs, Statement s) {
		if (rs != null) {
			try {
				rs.close();
			} catch (SQLException e) {
				e.printStackTrace();
			}
		}
		if (s != null) {
			try {
				s.close();
			} catch (SQLException e) {
				e.printStackTrace();
			}
		}
		if (connection != null) {
			try {
				connection.close();
			} catch (SQLException e) {
				e.printStackTrace();
			}
		}
	}

Side note: most people who are dealing directly with databases like this (rather than using a framework), tend to have a utility class that has methods for each of these, such as "closeResultSet", "closeStatement" and "closeConnection". They often also have multiple overriden "close" methods that then close whatever they are passed, even if they are passed multiple objects and/or alternating orders of objects.

You might also want to think about whether you really want to be opening and closing your connection (and loading your JDBC driver) every time you process a user request - lines 21,22,24,25,29 and 31 might be better in your init method (and loading the database configuration details based on the ServletConfig is generally considered a good thing).

In the code I showed above I have followed your convention of sending error information to standard out and standard error. This is not a good idea - depending on how your system is configured you may not ever see it. You really should learn to use the logger and send your log message to a guaranteed location.

I suspect that the problem is with your database code, not your web based code. You could test this quite easily by changing your doPost method to work without DB connectivity. For example:

	public void doPost(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		PrintWriter out = response.getWriter();
		String userName = new String("testUser");
		String passwrd = new String("testPassword");

		if (userName.equals(request.getParameter("user"))
				&& passwrd.equals(request.getParameter("pass"))) {
			out.println("User Authenticated");
		} else {
			out.println("You are not an authentic person");
		}
	}

See if you can login with the hard coded credentials there. If you can, then the problem is in the database code, and we can address that separately.

[roy ramos]

first of all thank you very very much for all of you who respond to this topic

Sir Andrew, i tried you're hard coded credentials and it able to proceed successfully

[Aditya Keyal]

Good so that pretty much solves your problem. There is an error in the database retrieval of the username and password. Please look into the server logs, identify the issue and then go ahead and solve it / log it in the correct forum.