Help required with login form using applet

Question

this is the code I'm working on. it does not show any errors but it does not successfully authenticate the login either.
please help
public class Loginex extends JApplet implements ActionListener
     public JPanel p;
     public JLabel l1,l2;
     public JTextField t1;
     public JPasswordField pw1;
     public JButton signin;
     public String uname,upwd,dname,dpwd;
     public void init()
          JPanel p=new JPanel();
          JLabel l1=new JLabel("Username");
          JLabel l2=new JLabel("Password");
          JTextField t1=new JTextField(20);
          JPasswordField pw1=new JPasswordField(20);
          JButton signin=new JButton("Sign in");
          p.add(l1);
          p.add(t1);
          p.add(l2);
          p.add(pw1);
          p.add(signin);
          signin.addActionListener(this);
          add(p);
          uname=t1.getText();
          upwd=pw1.getText();
     public void actionPerformed(ActionEvent ae)
          if(ae.getSource()==signin)
               System.out.println("You are trying to login as : "+uname);
          try
               Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
               Connection
con=DriverManager.getConnection("jdbc:sqlserver://localhost;"+"user=sa;password=sysdba;"+"database=job_app");
               Statement stm = con.createStatement();
               String query = "SELECT emp_id, emp_pwd FROM Employee where emp_id= "+uname +";";
               ResultSet rs = stm.executeQuery(query);
               while(rs.next())
                    dname=rs.getString("emp_id");
                    dpwd=rs.getString("emp_pwd");
                    if((dname.equals(uname))&&(dpwd.equals(upwd)))
                         System.out.println("You are logged in as : "+uname);
                    else
                         System.out.println("Login failed");
               rs.close();
               stm.close();
               con.close();
          catch(Exception e)
               System.out.println("Error occured"+e);
}

Answer 1

njb7ty wrote:
Also, if uname had a single quote such as O'Conner, the originial sql statement would fail unless you properly escape the single quote. With preparedStatements, you dont have to escape it. I also believe preparedStatements are less suseptable to sql injection attacks.You are correct, prepared statements are the best thing since sliced bread. They are:
- easier to read and write
- easier to debug
- run faster if used more than once
- and are not susceptible to SQL injection attacks, this is especially important if the data being used in the parameter came in over the internet.
I always use them, even when they might be slightly less efficient, eg. where I build the SQL right before I prepare it and then never use it again.