Database Connection problem please help

Question

Hi,
I have a servlet that basically connects to the database if the userid and password is correct.
I have a "login.html" page where the user enters the "userid" and "password".The servlet does the checking and grants access to the user.
My question is as follows.As soon as I startup tomcat type in the url login.html,then press the submit button,(both the fields are blank) the servlet says "ok" this is this information is present in the database.It should say "not ok".Hope I question is clear.The code for the servlet is given below.
package package1.structure;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.util.*;
import java.sql.*;
public class AuthenticateServlet2 extends HttpServlet {
private String user="";
private String pass="";
private String username="";
private String password="";
private String message1="";
public void init() {
try{
    Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
    System.out.println("Driver loaded successfully");
   }//close try
catch (ClassNotFoundException e) {
System.out.println(e.toString());
}//close catch
}//close init() method
public void doGet(HttpServletRequest request,HttpServletResponse response)throws ServletException, IOException
} //close doGet
public void doPost(HttpServletRequest request,HttpServletResponse response)
throws ServletException, IOException
  user = request.getParameter("username").trim();
  pass = request.getParameter("password").trim();
  System.out.println("*"+user+"*");
  System.out.println("*"+pass+"*");
  String message = null;
try{
  Connection con= DriverManager.getConnection("jdbc:odbc:MyDS");
  System.out.println("Successfully connected to database");
  PreparedStatement pstmt;
  pstmt = con.prepareStatement("SELECT username,password FROM users" + " WHERE username ='" + user + "'" +
  " AND password='" + pass + "'");
  ResultSet rs = pstmt.executeQuery();
  if(rs.next())
      username = rs.getString(1);
       password = rs.getString(2);     
if (username != null && password != null && user.equals(username) && pass.equals(password) ){
    message ="ok";
    PrintWriter out = response.getWriter();
    out.print("<B>" + message + "</B>");
    //response.sendRedirect ("http://localhost:8080/thankyou.html");
}//closes the if statement
else {
     message="not ok";
     PrintWriter out = response.getWriter();
     out.print("<B>" + message + "</B>");
    //response.sendRedirect ("http://localhost:8080/sampleapp/login.html");
}//close else statement
}//closes 2ndtry
catch (SQLException e) {
System.out.println(e.toString());
}//closes 2ndcatch
}//close doPost
}//close classKindly let me know ASAP.
Regarding the database.The fields in the database are "username" and "password" and it has one tuple
"xyz" and "xyz"
Hope that my question is rightly put.
Thanking you
AS

Answer 1

Actually, I think the servlet is doing the right thing
by printing "ok". A quick glance at your code tells
me that username and password are both members of your
servlet class and initialized to "". Neither is null,
and both are blank.
If your HTML page sends user and pass as blank
strings, you'll do a database query for those values.
If they don't appear in the database, your ResultSet
will have no rows and the username and password data
members will not be updated.
When you get to your if test, neither username nor
password is null and both are equal to the values
passed in from the HTML. Hence the "ok".
If you initialize your username and password members
to null this might still work.
Be sure to set them back to null when you finish the
test.
If you take all that JDBC code out of the servlet and
isolate it into its own class, you can test it out by
feeding it valid and invalid username and password
combinations. Once you've got that working perfectly,
you can just have the servlet instantiate your
database object and call its methods. If you have any
problems after that point, you know they're due to the
servlet and not the database interactions.
Right now the database and servlet are confounded.
Separate them out and you might make faster progress.
- MODHello,
Thanks for the reply.Will consider your points for a proper coding.Will keep posting.
AS