Can anyone see what the problem is?

Question

Hi
I get this message whilst trying to debug this jsp: SQLException:java.sql.SQLException: Syntax error or access violation, message from server:
"You have an error in your SQL syntax near email = 'null'AND password = 'null'' at line 1"
Here is the JSP code:
<%
String email = request.getParameter("username");
String password = request.getParameter("ppassword");
String user_type = null;
mylogin.connect();
ResultSet loginResult = mylogin.viewLogon(email, password);
loginResult.next();
if (loginResult != null)
%>
Incorrect Username or Password Entered. Please try again!
Please clickHere to Go Back!
<%
if (loginResult.first())
user_type = request.getParameter("user");
}else if (user_type.equals("patient"))
%>
<jsp:forward page="homepage.jsp" />
<%
}else if (user_type.equals("staff"))
%>
<jsp:forward page="outofhoursstaff.jsp" />
<% }else if (user_type.equals("admin"))
%>
<jsp:forward page="siteadminmain.jsp" />
<%
%>
<% mylogin.disconnect(); %>
Here is the JavaBean code:
public ResultSet viewLogon(String email, String password) throws SQLException, Exception
     ResultSet loginResult = null;
     try
          String queryString = ("SELECT user_type, email, password" +
                                   "FROM user" +
                                   "WHERE email = '"+email+"'" +
                                   "AND password = '"+password+"'");
          Statement statement = con.createStatement();
          Statement stmt = con.createStatement();
          loginResult = statement.executeQuery(queryString);
     catch (SQLException sqle)
          System.out.println("SQLException:" + sqle);
     catch (Exception e)
          System.out.println("Exception:" + e);
     return loginResult;
Any suggestions will be gratefully appreciated

Answer 1

I think you need some spaces in your code - It would have produced
SELECT user_type, email, passwordFROM userWHERE email ='null'AND password ='null'
You need to include spaces where you are concatenating the strings.
String queryString = ("SELECT user_type, email, password" +
" FROM user" +
" WHERE email = '"+email+"'" +
" AND password = '"+password+"'");
As an aside, I would also suggest that you use a prepared statement, and substitute in the parameters
ie WHERE email = ? and password = ?
This will
- Protect you from stupid people who put quotes in their passwords
- prevent SQL injection attacks.
Cheers,
evnafets