Verifying Username & Password

[Ranjeet Deshmukh]

Hi All,

I'm doing JDBC with Mysql 5.2, I'm storing my password using md5 encryption. Program should show error message when password entered from command line is not matched with password stored in DB. Tell me what will to replace "?" in if().

My code is:-

package test;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.Reader;
import java.sql.*;

public class JDBCDemo {

	
	
	
	public static void main(String[] args) throws ClassNotFoundException, SQLException, IOException {
		
		String connUrl="jdbc:mysql://localhost:3306/emp";
		String username="root";
		String password="7535";
		String Username,Password,input;
		char c;
		
		Class.forName("com.mysql.jdbc.Driver");
		Connection conn = DriverManager.getConnection(connUrl,username,password);
		Statement st = conn.createStatement();
		
			
			
		BufferedReader br= new BufferedReader(new InputStreamReader(System.in));
		
		do{
			
			System.out.println("Entert the Password ");
			Password = br.readLine();
			
			
			String query="select * from emp.md5_tbl where md5_val=(MD5('"+Password+"'));";
			ResultSet rs= st.executeQuery(query);
		
			

//Here is the needed condition to match password field in DB with entered Password From Command line.

                        if(?)
			
                        {
				System.out.println("Wrong Password!!! Please Try Again....");
			}
			else
				while(rs.next())
				{
					System.out.println("Welcome "+rs.getString(1)+", Entered password is correct!!!");
			
				}
				
			
			System.out.println("Do you want to continue(y/n) :- ");
			  input = br.readLine();
			   c= input.charAt(0);
			
		}while(c=='y'|| c=='Y');
	}
}

[Campbell Ritchie]

Why are you using a password without a user name? Why are you showing the password in clear on the command terminal? Why have you got the root password unencrypted in that code? Why have you got pairs of variables which differ only in the case of their first letter?

[Ranjeet Deshmukh]

Campbell Ritchie wrote:Why are you using a password without a user name? Why are you showing the password in clear on the command terminal? Why have you got the root password unencrypted in that code? Why have you got pairs of variables which differ only in the case of their first letter?

This is just a basic program, I'm accepting password and if it is correct then I'm greeting the user with username associated with password and if password is wrong then displaying an error message. "Password" is accepting the password from user at CL and "password" contains the root password for Mysql.

[Campbell Ritchie]

You would have to check the password against those retrieved. If it is an MD5, what form does it return the result in? Is it a BigInteger? Use its equals() method. What you are doing is working out an existential quantification
∃x • MD5(x) ∈ passwordMD5s
What you ought to do is use a password field or the Console class’ method for password, and ask for user name and password before you set up the connection at all. Don’t use the root password.